From 982761ce44fae416fb26a93dfd206dacfc5a1661 Mon Sep 17 00:00:00 2001
From: aws-sdk-kotlin-ci Describes an OpenSearch data source configuration. As of September 2021, Amazon Elasticsearch service is Amazon OpenSearch Service. This configuration is\n deprecated. For new data sources, use OpenSearchServiceDataSourceConfig to specify an OpenSearch data source. Retrieves the list of environmental variable key-value pairs associated with an API by its ID value. The ID of the API from which the environmental variable list will be retrieved. The payload containing each environmental variable in the The pipeline configuration for a resolver of kind Creates a list of environmental variables in an API by its ID value. When creating an environmental variable, it must follow the constraints below: Both JavaScript and VTL templates support environmental variables. Environmental variables are not evaluated before function invocation. Environmental variables only support string values. Any defined value in an environmental variable is considered a string literal and not\n expanded. Variable evaluations should ideally be performed in the function code. When creating an environmental variable key-value pair, it must follow the additional constraints\n below: Keys must begin with a letter. Keys must be at least two characters long. Keys can only contain letters, numbers, and the underscore character (_). Values can be up to 512 characters long. You can configure up to 50 key-value pairs in a GraphQL API. You can create a list of environmental variables by adding it to the The ID of the API to which the environmental variable list will be written. The list of environmental variables to add to the API. When creating an environmental variable key-value pair, it must follow the additional constraints\n below: Keys must begin with a letter. Keys must be at least two characters long. Keys can only contain letters, numbers, and the underscore character (_). Values can be up to 512 characters long. You can configure up to 50 key-value pairs in a GraphQL API. You can create a list of environmental variables by adding it to the The payload containing each environmental variable in the Creates a log group with the specified name. You can create up to 1,000,000 log groups per Region per account. You must use the following guidelines when naming a log group: Log group names must be unique within a Region for an Amazon Web Services\n account. Log group names can be between 1 and 512 characters long. Log group names consist of the following characters: a-z, A-Z, 0-9, '_' (underscore), '-' (hyphen), \n '/' (forward slash), '.' (period), and '#' (number sign) When you create a log group, by default the log events in the log group do not expire.\n To set a retention policy so that events expire and are deleted after a specified time, use\n PutRetentionPolicy. If you associate an KMS key with the log group, ingested data is\n encrypted using the KMS key. This association is stored as long as the data\n encrypted with the KMS key is still within CloudWatch Logs. This enables\n CloudWatch Logs to decrypt this data whenever it is requested. If you attempt to associate a KMS key with the log group but the KMS key does not exist or the KMS key is disabled, you receive an\n CloudWatch Logs supports only symmetric KMS keys. Do not associate an\n asymmetric KMS key with your log group. For more information, see Using\n Symmetric and Asymmetric Keys. Creates a log group with the specified name. You can create up to 1,000,000 log groups per Region per account. You must use the following guidelines when naming a log group: Log group names must be unique within a Region for an Amazon Web Services\n account. Log group names can be between 1 and 512 characters long. Log group names consist of the following characters: a-z, A-Z, 0-9, '_' (underscore), '-' (hyphen), \n '/' (forward slash), '.' (period), and '#' (number sign) Log group names can't start with the string When you create a log group, by default the log events in the log group do not expire.\n To set a retention policy so that events expire and are deleted after a specified time, use\n PutRetentionPolicy. If you associate an KMS key with the log group, ingested data is\n encrypted using the KMS key. This association is stored as long as the data\n encrypted with the KMS key is still within CloudWatch Logs. This enables\n CloudWatch Logs to decrypt this data whenever it is requested. If you attempt to associate a KMS key with the log group but the KMS key does not exist or the KMS key is disabled, you receive an\n CloudWatch Logs supports only symmetric KMS keys. Do not associate an\n asymmetric KMS key with your log group. For more information, see Using\n Symmetric and Asymmetric Keys. Retrieves a list of the deliveries that have been created in the account. Retrieves a list of the deliveries that have been created in the account. A delivery is a \n connection between a \n delivery source\n and a \n \n delivery destination\n . A delivery source represents an Amazon Web Services resource that sends logs to an logs delivery destination. \n The destination can be CloudWatch Logs, Amazon S3, or Kinesis Data Firehose. \n Only some Amazon Web Services services support being configured as a delivery source. These services are listed\n in Enable logging from Amazon Web Services \n services.\n Returns complete information about one delivery. A delivery is a connection between a logical delivery source and a logical\n delivery destination\n You need to specify the delivery Returns complete information about one logical delivery. A delivery is a \n connection between a \n delivery source\n and a \n \n delivery destination\n . A delivery source represents an Amazon Web Services resource that sends logs to an logs delivery destination. \n The destination can be CloudWatch Logs, Amazon S3, or Kinesis Data Firehose. \n Only some Amazon Web Services services support being configured as a delivery source. These services are listed\n in Enable logging from Amazon Web Services \n services.\n You need to specify the delivery The Amazon Resource Name (ARN) of the log group. The Amazon Resource Name (ARN) of the log group. This version of the ARN includes a trailing Use this version to refer to the ARN in IAM policies when specifying permissions for most API actions. The exception is when specifying permissions for TagResource, UntagResource, and \n ListTagsForResource. \n The permissions for those three actions require the ARN version that doesn't include a trailing This specifies the log group class for this log group. There are two classes: The The For details about the features supported by each class, see \n Log classes\n The Amazon Resource Name (ARN) of the log group. This version of the ARN doesn't include a trailing Use this version to refer to the ARN in the following situations: In the In the In IAM policies, when specifying permissions for TagResource, UntagResource, and \n ListTagsForResource. Defines the type of log that the source is sending. For valid values for this parameter, see the documentation for\n the source service. Defines the type of log that the source is sending. For Amazon CodeWhisperer, the valid value is \n A list of namespaced kernel parameters to set in the container. This parameter maps to\n\t\t\t\t We don't recommended that you specify network-related This parameter is not supported for Windows containers. This parameter is only supported for tasks that are hosted on\n Fargate if the tasks are using platform version A list of namespaced kernel parameters to set in the container. This parameter maps to\n\t\t\t The infrastructure that you run your service on. For more information, see Amazon ECS\n\t\t\t\tlaunch types in the Amazon Elastic Container Service Developer Guide. The Fargate Spot infrastructure is available for use but a capacity provider\n\t\t\t\tstrategy must be used. For more information, see Fargate capacity providers in the\n\t\t\t\t\tAmazon ECS User Guide for Fargate. The The A service can use either a launch type or a capacity provider strategy. If a\n\t\t\t\t The infrastructure that you run your service on. For more information, see Amazon ECS\n\t\t\t\tlaunch types in the Amazon Elastic Container Service Developer Guide. The Fargate Spot infrastructure is available for use but a capacity provider\n\t\t\t\tstrategy must be used. For more information, see Fargate capacity providers in the\n\t\t\t\t\tAmazon ECS User Guide for Fargate. The The A service can use either a launch type or a capacity provider strategy. If a\n\t\t\t\t The amount of ephemeral storage to allocate for the task. This parameter is used to\n\t\t\texpand the total amount of ephemeral storage available, beyond the default amount, for\n\t\t\ttasks hosted on Fargate. For more information, see Fargate task\n\t\t\t\tstorage in the Amazon ECS User Guide for Fargate. For tasks using the Fargate launch type, the task requires the\n\t\t\t\tfollowing platforms: Linux platform version Windows platform version The amount of ephemeral storage to allocate for the task. This parameter is used to\n\t\t\texpand the total amount of ephemeral storage available, beyond the default amount, for\n\t\t\ttasks hosted on Fargate. For more information, see Using data volumes in tasks in the Amazon ECS Developer Guide;. For tasks using the Fargate launch type, the task requires the\n\t\t\t\tfollowing platforms: Linux platform version Windows platform version The name of the container (as it appears in a container definition) to associate with\n\t\t\tthe load balancer. The name of the container (as it appears in a container definition) to associate with\n\t\t\tthe load balancer. You need to specify the container name when configuring the target group for an Amazon ECS\n\t\t\tload balancer. The amount of ephemeral storage to allocate for the task. This parameter is used to\n\t\t\texpand the total amount of ephemeral storage available, beyond the default amount, for\n\t\t\ttasks hosted on Fargate. For more information, see Fargate task\n\t\t\t\tstorage in the Amazon ECS User Guide for Fargate. For tasks using the Fargate launch type, the task requires the\n\t\t\t\tfollowing platforms: Linux platform version Windows platform version The amount of ephemeral storage to allocate for the task. This parameter is used to\n\t\t\texpand the total amount of ephemeral storage available, beyond the default amount, for\n\t\t\ttasks hosted on Fargate. For more information, see Using data volumes in tasks in the Amazon ECS Developer Guide. For tasks using the Fargate launch type, the task requires the\n\t\t\t\tfollowing platforms: Linux platform version Windows platform version The infrastructure to run your standalone task on. For more information, see Amazon ECS\n\t\t\t\tlaunch types in the Amazon Elastic Container Service Developer Guide. The Fargate Spot infrastructure is available for use but a capacity provider\n\t\t\t\tstrategy must be used. For more information, see Fargate capacity providers in the\n\t\t\t\t\tAmazon ECS User Guide for Fargate. The The A task can use either a launch type or a capacity provider strategy. If a\n\t\t\t\t When you use cluster auto scaling, you must specify\n\t\t\t\t The infrastructure to run your standalone task on. For more information, see Amazon ECS\n\t\t\t\tlaunch types in the Amazon Elastic Container Service Developer Guide. The Fargate Spot infrastructure is available for use but a capacity provider\n\t\t\t\tstrategy must be used. For more information, see Fargate capacity providers in the\n\t\t\t\t\tAmazon ECS Developer Guide. The The A task can use either a launch type or a capacity provider strategy. If a\n\t\t\t\t When you use cluster auto scaling, you must specify\n\t\t\t\t A list of namespaced kernel parameters to set in the container. This parameter maps to\n\t\t\t\t We don't recommend that you specify network-related For tasks that use the For tasks that use the A list of namespaced kernel parameters to set in the container. This parameter maps to\n\t\t\t We don't recommend that you specify network-related For tasks that use the For tasks that use the If you're setting an IPC resource namespace to use for the containers in the task, the\n\t\t\tfollowing conditions apply to your system controls. For more information, see IPC mode. For tasks that use the For tasks that use the This parameter is not supported for Windows containers. This parameter is only supported for tasks that are hosted on\n Fargate if the tasks are using platform version The stop code indicating why a task was stopped. The For more information about stop code, see Stopped tasks error codes in the Amazon ECS User Guide. The stop code indicating why a task was stopped. The For more information about stop code, see Stopped tasks error codes in the Amazon ECS Developer Guide. Cancels a pending configuration change on an Amazon OpenSearch Service domain. Name of the OpenSearch Service domain configuration request to cancel. When set to True, returns the list of change IDs and properties that will be cancelled without actually cancelling the change. Container for parameters of the Whether or not the request was a dry run. If True, the changes were not actually cancelled. The unique identifiers of the changes that were cancelled. The domain change properties that were cancelled. Contains the details of the cancelled domain config change. The name of the property whose change was cancelled. The pending value of the property that was cancelled. This would have been the eventual value of the property if the chance had not been cancelled. The current value of the property, after the change was cancelled. A property change that was cancelled for an Amazon OpenSearch Service domain. Contains an optional message associated with the domain configuration change. The current status of the configuration change. The time that the configuration change was initiated, in Universal Coordinated Time (UTC). The last time that the configuration change was updated. The IAM principal who initiated the configuration change. The specific stages that the domain is going through to perform the configuration change. The current status of the configuration change. The last time that the status of the configuration change was updated. The IAM principal who initiated the configuration change. \n A map from an\n Specifies change details of the domain configuration change. Information about the domain properties that are currently being modified. Specifies change details of the domain configuration change. The status of any changes that are currently in progress for the domain. Information about the domain properties that are currently being modified. \n Minimum number of Instances that can be instantiated for given InstanceType.\n The name of the property that is currently being modified. The current value of the domain property that is being modified. The value that the property that is currently being modified will eventually have. The type of value that is currently being modified. Properties can have two types: Information about the domain properties that are currently being modified. Specifies the type of AWS account permitted to manage VPC endpoints.:\n \"key\" : \"value\"
format.PIPELINE
.\n
\n \n
\n environmentVariables
\n payload as a list in the format {\"key1\":\"value1\",\"key2\":\"value2\", …}
. Note that each call of the\n PutGraphqlApiEnvironmentVariables
action will result in the overwriting of the existing\n environmental variable list of that API. This means the existing environmental variables will be lost. To avoid\n this, you must include all existing and new environmental variables in the list each time you call this\n action.\n
\n environmentVariables
\n payload as a list in the format {\"key1\":\"value1\",\"key2\":\"value2\", …}
. Note that each call of the\n PutGraphqlApiEnvironmentVariables
action will result in the overwriting of the existing\n environmental variable list of that API. This means the existing environmental variables will be lost. To avoid\n this, you must include all existing and new environmental variables in the list each time you call this\n action.\"key\" : \"value\"
format.\n
\n InvalidParameterException
error. \n
\n aws/
\n InvalidParameterException
error. id
in this operation. You can find the IDs of the deliveries in your account with the \n DescribeDeliveries operation.id
in this operation. You can find the IDs of the deliveries in your account with the \n DescribeDeliveries operation.:*
after the log group name. :*
.\n
\n Standard
log class supports all CloudWatch Logs features.Infrequent Access
log class supports a subset of CloudWatch Logs features\n and incurs lower costs.:*
after the log group name. \n
"
+ }
}
},
"traits": {
@@ -7119,7 +7125,7 @@
"logType": {
"target": "com.amazonaws.cloudwatchlogs#LogType",
"traits": {
- "smithy.api#documentation": "logGroupIdentifier
input field in many CloudWatch Logs APIs.resourceArn
field in tagging APIsEVENT_LOGS
.Sysctls
in the Create a container section of the\n\t\t\tDocker Remote API and the --sysctl
option to docker run. For example, you can configure\n\t\t\t\tnet.ipv4.tcp_keepalive_time
setting to maintain longer lived\n\t\t\tconnections.systemControls
\n\t\t\t\tparameters for multiple containers in a single task that also uses either the\n\t\t\t\t\tawsvpc
or host
network modes. For tasks that use the\n\t\t\t\t\tawsvpc
network mode, the container that's started last determines\n\t\t\t\twhich systemControls
parameters take effect. For tasks that use the\n\t\t\t\t\thost
network mode, it changes the container instance's namespaced\n\t\t\t\tkernel parameters as well as the containers.1.4.0
or later\n (Linux). This isn't supported for Windows containers on\n Fargate.Sysctls
in the Create a container section of the\n\t\t\tDocker Remote API and the --sysctl
option to docker run. For example, you can configure\n\t\t\tnet.ipv4.tcp_keepalive_time
setting to maintain longer lived\n\t\t\tconnections.FARGATE
launch type runs your tasks on Fargate On-Demand\n\t\t\tinfrastructure.EC2
launch type runs your tasks on Amazon EC2 instances registered to your\n\t\t\tcluster.EXTERNAL
launch type runs your tasks on your on-premises server or\n\t\t\tvirtual machine (VM) capacity registered to your cluster.launchType
is specified, the capacityProviderStrategy
\n\t\t\tparameter must be omitted.FARGATE
launch type runs your tasks on Fargate On-Demand\n\t\t\tinfrastructure.EC2
launch type runs your tasks on Amazon EC2 instances registered to your\n\t\t\tcluster.EXTERNAL
launch type runs your tasks on your on-premises server or\n\t\t\tvirtual machine (VM) capacity registered to your cluster.launchType
is specified, the capacityProviderStrategy
\n\t\t\tparameter must be omitted.\n
\n 1.4.0
or later.1.0.0
or later.\n
\n 1.4.0
or later.1.0.0
or later.\n
\n 1.4.0
or later.1.0.0
or later.\n
\n 1.4.0
or later.1.0.0
or later.FARGATE
launch type runs your tasks on Fargate On-Demand\n\t\t\tinfrastructure.EC2
launch type runs your tasks on Amazon EC2 instances registered to your\n\t\t\tcluster.EXTERNAL
launch type runs your tasks on your on-premises server or\n\t\t\tvirtual machine (VM) capacity registered to your cluster.launchType
is specified, the capacityProviderStrategy
\n\t\t\tparameter must be omitted.capacityProviderStrategy
and not launchType
. FARGATE
launch type runs your tasks on Fargate On-Demand\n\t\t\tinfrastructure.EC2
launch type runs your tasks on Amazon EC2 instances registered to your\n\t\t\tcluster.EXTERNAL
launch type runs your tasks on your on-premises server or\n\t\t\tvirtual machine (VM) capacity registered to your cluster.launchType
is specified, the capacityProviderStrategy
\n\t\t\tparameter must be omitted.capacityProviderStrategy
and not launchType
. Sysctls
in the Create a container section of the\n\t\t\tDocker Remote API and the --sysctl
option to docker run.systemControls
\n\t\t\tparameters for multiple containers in a single task. This task also uses either the\n\t\t\t\tawsvpc
or host
network mode. It does it for the following\n\t\t\treasons.\n
"
+ "smithy.api#documentation": "awsvpc
network mode, if you set\n\t\t\t\t\t\tsystemControls
for any container, it applies to all containers\n\t\t\t\t\tin the task. If you set different systemControls
for multiple\n\t\t\t\t\tcontainers in a single task, the container that's started last determines which\n\t\t\t\t\t\tsystemControls
take effect.host
network mode, the\n\t\t\t\t\t\tsystemControls
parameter applies to the container instance's\n\t\t\t\t\tkernel parameter and that of all containers of any tasks running on that\n\t\t\t\t\tcontainer instance.Sysctls
in the Create a container section of the\n\t\t\tDocker Remote API and the --sysctl
option to docker run. For example, you can configure\n\t\t\tnet.ipv4.tcp_keepalive_time
setting to maintain longer lived\n\t\t\tconnections.systemControls
\n\t\t\tparameters for multiple containers in a single task that also uses either the\n\t\t\tawsvpc
or host
network mode. Doing this has the following\n\t\t\tdisadvantages:\n
\n awsvpc
network mode including Fargate,\n\t\t\t\t\tif you set systemControls
for any container, it applies to all\n\t\t\t\t\tcontainers in the task. If you set different systemControls
for\n\t\t\t\t\tmultiple containers in a single task, the container that's started last\n\t\t\t\t\tdetermines which systemControls
take effect.host
network mode, the network namespace\n\t\t\t\t\tsystemControls
aren't supported.\n
\n host
IPC mode, IPC namespace\n\t\t\t\t\tsystemControls
aren't supported.task
IPC mode, IPC namespace\n\t\t\t\t\tsystemControls
values apply to all containers within a\n\t\t\t\t\ttask.1.4.0
or later\n (Linux). This isn't supported for Windows containers on\n Fargate.stoppedReason
might\n\t\t\tcontain additional details. stoppedReason
might\n\t\t\tcontain additional details. CancelDomainConfigChange
operation.\n ElasticsearchVersion\n
\n to a list of compatible\n \n ElasticsearchVersion\n
\n s to which the domain can be upgraded.\n \n
"
+ }
+ }
+ },
+ "traits": {
+ "smithy.api#documentation": "\n
\n
Cancels a pending configuration change on an Amazon OpenSearch Service domain.
", + "smithy.api#http": { + "method": "POST", + "uri": "/2021-01-01/opensearch/domain/{DomainName}/config/cancel", + "code": 200 + } + } + }, + "com.amazonaws.opensearch#CancelDomainConfigChangeRequest": { + "type": "structure", + "members": { + "DomainName": { + "target": "com.amazonaws.opensearch#DomainName", + "traits": { + "smithy.api#httpLabel": {}, + "smithy.api#required": {} + } + }, + "DryRun": { + "target": "com.amazonaws.opensearch#DryRun", + "traits": { + "smithy.api#documentation": "When set to True
, returns the list of change IDs and properties that will be cancelled without actually cancelling the change.
The unique identifiers of the changes that were cancelled.
" + } + }, + "CancelledChangeProperties": { + "target": "com.amazonaws.opensearch#CancelledChangePropertyList", + "traits": { + "smithy.api#documentation": "The domain change properties that were cancelled.
" + } + }, + "DryRun": { + "target": "com.amazonaws.opensearch#DryRun", + "traits": { + "smithy.api#documentation": "Whether or not the request was a dry run. If True
, the changes were not actually cancelled.
The name of the property whose change was cancelled.
" + } + }, + "CancelledValue": { + "target": "com.amazonaws.opensearch#String", + "traits": { + "smithy.api#documentation": "The pending value of the property that was cancelled. This would have been the eventual value of the property if the chance had not been cancelled.
" + } + }, + "ActiveValue": { + "target": "com.amazonaws.opensearch#String", + "traits": { + "smithy.api#documentation": "The current value of the property, after the change was cancelled.
" + } + } + }, + "traits": { + "smithy.api#documentation": "A property change that was cancelled for an Amazon OpenSearch Service domain.
" + } + }, + "com.amazonaws.opensearch#CancelledChangePropertyList": { + "type": "list", + "member": { + "target": "com.amazonaws.opensearch#CancelledChangeProperty" + } + }, "com.amazonaws.opensearch#ChangeProgressDetails": { "type": "structure", "members": { @@ -2517,6 +2633,30 @@ "traits": { "smithy.api#documentation": "A message corresponding to the status of the configuration change.
" } + }, + "ConfigChangeStatus": { + "target": "com.amazonaws.opensearch#ConfigChangeStatus", + "traits": { + "smithy.api#documentation": "The current status of the configuration change.
" + } + }, + "InitiatedBy": { + "target": "com.amazonaws.opensearch#InitiatedBy", + "traits": { + "smithy.api#documentation": "The IAM principal who initiated the configuration change.
" + } + }, + "StartTime": { + "target": "com.amazonaws.opensearch#UpdateTimestamp", + "traits": { + "smithy.api#documentation": "The time that the configuration change was initiated, in Universal Coordinated Time (UTC).
" + } + }, + "LastUpdatedTime": { + "target": "com.amazonaws.opensearch#UpdateTimestamp", + "traits": { + "smithy.api#documentation": "The last time that the configuration change was updated.
" + } } }, "traits": { @@ -2627,6 +2767,24 @@ "traits": { "smithy.api#documentation": "The specific stages that the domain is going through to perform the configuration change.
" } + }, + "LastUpdatedTime": { + "target": "com.amazonaws.opensearch#UpdateTimestamp", + "traits": { + "smithy.api#documentation": "The last time that the status of the configuration change was updated.
" + } + }, + "ConfigChangeStatus": { + "target": "com.amazonaws.opensearch#ConfigChangeStatus", + "traits": { + "smithy.api#documentation": "The current status of the configuration change.
" + } + }, + "InitiatedBy": { + "target": "com.amazonaws.opensearch#InitiatedBy", + "traits": { + "smithy.api#documentation": "The IAM principal who initiated the configuration change.
" + } } }, "traits": { @@ -2859,6 +3017,59 @@ "smithy.api#documentation": "A map of OpenSearch or Elasticsearch versions and the versions you can upgrade them\n to.
" } }, + "com.amazonaws.opensearch#ConfigChangeStatus": { + "type": "enum", + "members": { + "PENDING": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "Pending" + } + }, + "INITIALIZING": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "Initializing" + } + }, + "VALIDATING": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "Validating" + } + }, + "VALIDATION_FAILED": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "ValidationFailed" + } + }, + "APPLYING_CHANGES": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "ApplyingChanges" + } + }, + "COMPLETED": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "Completed" + } + }, + "PENDING_USER_INPUT": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "PendingUserInput" + } + }, + "CANCELLED": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "Cancelled" + } + } + } + }, "com.amazonaws.opensearch#ConflictException": { "type": "structure", "members": { @@ -5458,6 +5669,12 @@ "traits": { "smithy.api#documentation": "Software update options for the domain.
" } + }, + "ModifyingProperties": { + "target": "com.amazonaws.opensearch#ModifyingPropertiesList", + "traits": { + "smithy.api#documentation": "Information about the domain properties that are currently being modified.
" + } } }, "traits": { @@ -5866,6 +6083,53 @@ } } }, + "com.amazonaws.opensearch#DomainProcessingStatusType": { + "type": "enum", + "members": { + "CREATING": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "Creating" + } + }, + "ACTIVE": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "Active" + } + }, + "MODIFYING": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "Modifying" + } + }, + "UPGRADING": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "UpgradingEngineVersion" + } + }, + "UPDATING": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "UpdatingServiceSoftware" + } + }, + "ISOLATED": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "Isolated" + } + }, + "DELETING": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "Deleting" + } + } + } + }, "com.amazonaws.opensearch#DomainState": { "type": "enum", "members": { @@ -6069,6 +6333,18 @@ "traits": { "smithy.api#documentation": "Service software update options for the domain.
" } + }, + "DomainProcessingStatus": { + "target": "com.amazonaws.opensearch#DomainProcessingStatusType", + "traits": { + "smithy.api#documentation": "The status of any changes that are currently in progress for the domain.
" + } + }, + "ModifyingProperties": { + "target": "com.amazonaws.opensearch#ModifyingPropertiesList", + "traits": { + "smithy.api#documentation": "Information about the domain properties that are currently being modified.
" + } } }, "traits": { @@ -6276,7 +6552,7 @@ } }, "traits": { - "smithy.api#documentation": "Specifies whether the domain should encrypt data at rest, and if so, the Key Management\n Service (KMS) key to use. Can be used only to create a new domain, not update an existing\n one.
" + "smithy.api#documentation": "Specifies whether the domain should encrypt data at rest, and if so, the Key Management\n Service (KMS) key to use. Can only be used when creating a new domain or enabling encryption at rest\n for the first time on an existing domain. You can't modify this parameter after it's already been\n specified.
" } }, "com.amazonaws.opensearch#EncryptionAtRestOptionsStatus": { @@ -6421,6 +6697,12 @@ "smithy.api#pattern": "^\\p{XDigit}{8}-\\p{XDigit}{4}-\\p{XDigit}{4}-\\p{XDigit}{4}-\\p{XDigit}{12}$" } }, + "com.amazonaws.opensearch#GUIDList": { + "type": "list", + "member": { + "target": "com.amazonaws.opensearch#GUID" + } + }, "com.amazonaws.opensearch#GetCompatibleVersions": { "type": "operation", "input": { @@ -7112,6 +7394,23 @@ "target": "com.amazonaws.opensearch#InboundConnection" } }, + "com.amazonaws.opensearch#InitiatedBy": { + "type": "enum", + "members": { + "CUSTOMER": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "CUSTOMER" + } + }, + "SERVICE": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "SERVICE" + } + } + } + }, "com.amazonaws.opensearch#InstanceCount": { "type": "integer", "traits": { @@ -8585,6 +8884,44 @@ "smithy.api#documentation": "Minimum number of instances that can be instantiated for a given instance type.
" } }, + "com.amazonaws.opensearch#ModifyingProperties": { + "type": "structure", + "members": { + "Name": { + "target": "com.amazonaws.opensearch#String", + "traits": { + "smithy.api#documentation": "The name of the property that is currently being modified.
" + } + }, + "ActiveValue": { + "target": "com.amazonaws.opensearch#String", + "traits": { + "smithy.api#documentation": "The current value of the domain property that is being modified.
" + } + }, + "PendingValue": { + "target": "com.amazonaws.opensearch#String", + "traits": { + "smithy.api#documentation": "The value that the property that is currently being modified will eventually have.
" + } + }, + "ValueType": { + "target": "com.amazonaws.opensearch#PropertyValueType", + "traits": { + "smithy.api#documentation": "The type of value that is currently being modified. Properties can have two types:
\n\n PLAIN_TEXT
: Contain direct values such as \"1\", \"True\", or \"c5.large.search\".
\n STRINGIFIED_JSON
: Contain content in JSON format, such as {\"Enabled\":\"True\"}\".
Information about the domain properties that are currently being modified.
" + } + }, + "com.amazonaws.opensearch#ModifyingPropertiesList": { + "type": "list", + "member": { + "target": "com.amazonaws.opensearch#ModifyingProperties" + } + }, "com.amazonaws.opensearch#NextToken": { "type": "string", "traits": { @@ -9962,6 +10299,23 @@ } } }, + "com.amazonaws.opensearch#PropertyValueType": { + "type": "enum", + "members": { + "PLAIN_TEXT": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "PLAIN_TEXT" + } + }, + "STRINGIFIED_JSON": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "STRINGIFIED_JSON" + } + } + } + }, "com.amazonaws.opensearch#PurchaseReservedInstanceOffering": { "type": "operation", "input": { diff --git a/codegen/sdk/aws-models/wafv2.json b/codegen/sdk/aws-models/wafv2.json index cf87a87ab3e..730e2ab2f99 100644 --- a/codegen/sdk/aws-models/wafv2.json +++ b/codegen/sdk/aws-models/wafv2.json @@ -221,6 +221,9 @@ { "target": "com.amazonaws.wafv2#CreateWebACL" }, + { + "target": "com.amazonaws.wafv2#DeleteAPIKey" + }, { "target": "com.amazonaws.wafv2#DeleteFirewallManagerRuleGroups" }, @@ -1754,7 +1757,7 @@ } ], "traits": { - "smithy.api#documentation": "Associates a web ACL with a regional application resource, to protect the resource.\n A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.
\nFor Amazon CloudFront, don't use this call. Instead, use your CloudFront distribution configuration. To\n associate a web ACL, in the CloudFront call UpdateDistribution
, set the web ACL ID\n to the Amazon Resource Name (ARN) of the web ACL. For information, see UpdateDistribution in the Amazon CloudFront Developer Guide.
When you make changes to web ACLs or web ACL components, like rules and rule groups, WAF propagates the changes everywhere that the web ACL and its components are stored and used. Your changes are applied within seconds, but there might be a brief period of inconsistency when the changes have arrived in some places and not in others. So, for example, if you change a rule action setting, the action might be the old action in one area and the new action in another area. Or if you add an IP address to an IP set used in a blocking rule, the new address might briefly be blocked in one area while still allowed in another. This temporary inconsistency can occur when you first associate a web ACL with an Amazon Web Services resource and when you change a web ACL that is already associated with a resource. Generally, any inconsistencies of this type last only a few seconds.
" + "smithy.api#documentation": "Associates a web ACL with a regional application resource, to protect the resource.\n A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.
\nFor Amazon CloudFront, don't use this call. Instead, use your CloudFront distribution configuration. To\n associate a web ACL, in the CloudFront call UpdateDistribution
, set the web ACL ID\n to the Amazon Resource Name (ARN) of the web ACL. For information, see UpdateDistribution in the Amazon CloudFront Developer Guide.
\n Required permissions for customer-managed IAM policies\n
\nThis call requires permissions that are specific to the protected resource type. \n For details, see Permissions for AssociateWebACL in the WAF Developer Guide.
\n\n Temporary inconsistencies during updates\n
\nWhen you create or change a web ACL or other WAF resources, the changes take a small amount of time to propagate to all areas where the resources are stored. The propagation time can be from a few seconds to a number of minutes.
\nThe following are examples of the temporary inconsistencies that you might notice during change propagation:
\nAfter you create a web ACL, if you try to associate it with a resource, you might get an exception indicating that the web ACL is unavailable.
\nAfter you add a rule group to a web ACL, the new rule group rules might be in effect in one area where the web ACL is used and not in another.
\nAfter you change a rule action setting, you might see the old action in some places and the new action in others.
\nAfter you add an IP address to an IP set that is in use in a blocking rule, the new address might be blocked in one area while still allowed in another.
\nA string value that you want WAF to search for. WAF searches only in the part of\n web requests that you designate for inspection in FieldToMatch. The\n maximum length of the value is 200 bytes.
\nValid values depend on the component that you specify for inspection in\n FieldToMatch
:
\n Method
: The HTTP method that you want WAF to search for. This\n indicates the type of operation specified in the request.
\n UriPath
: The value that you want WAF to search for in the URI path,\n for example, /images/daily-ad.jpg
.
\n JA3Fingerprint
: Match against the request's JA3 fingerprint. The JA3 fingerprint is a 32-character hash derived from the TLS Client Hello of an incoming request. This fingerprint serves as a unique identifier for the client's TLS configuration. You can use this choice only with a string match ByteMatchStatement
with the PositionalConstraint
set to \n EXACTLY
.
You can obtain the JA3 fingerprint for client requests from the web ACL logs. \n\t\t\t\t\t\tIf WAF is able to calculate the fingerprint, it includes it in the logs. \n\t\t\t\t\t\tFor information about the logging fields, \nsee Log fields in the WAF Developer Guide.
\n\n HeaderOrder
: The comma-separated list of header names to match for. WAF creates a \n string that contains the ordered list of header names, from the headers in the web request, and then matches against that string.
If SearchString
includes alphabetic characters A-Z and a-z, note that the\n value is case sensitive.
\n If you're using the WAF API\n
\nSpecify a base64-encoded version of the value. The maximum length of the value before\n you base64-encode it is 200 bytes.
\nFor example, suppose the value of Type
is HEADER
and the value\n of Data
is User-Agent
. If you want to search the\n User-Agent
header for the value BadBot
, you base64-encode\n BadBot
using MIME base64-encoding and include the resulting value,\n QmFkQm90
, in the value of SearchString
.
\n If you're using the CLI or one of the Amazon Web Services SDKs\n
\nThe value that you want WAF to search for. The SDK automatically base64 encodes the\n value.
", + "smithy.api#documentation": "A string value that you want WAF to search for. WAF searches only in the part of\n web requests that you designate for inspection in FieldToMatch. The\n maximum length of the value is 200 bytes.
\nValid values depend on the component that you specify for inspection in\n FieldToMatch
:
\n Method
: The HTTP method that you want WAF to search for. This\n indicates the type of operation specified in the request.
\n UriPath
: The value that you want WAF to search for in the URI path,\n for example, /images/daily-ad.jpg
.
\n JA3Fingerprint
: Match against the request's JA3 fingerprint. The JA3 fingerprint is a 32-character hash derived from the TLS Client Hello of an incoming request. This fingerprint serves as a unique identifier for the client's TLS configuration. You can use this choice only with a string match ByteMatchStatement
with the PositionalConstraint
set to \n EXACTLY
.
You can obtain the JA3 fingerprint for client requests from the web ACL logs. \n\t\t\t\t\t\tIf WAF is able to calculate the fingerprint, it includes it in the logs. \n\t\t\t\t\t\tFor information about the logging fields, \nsee Log fields in the WAF Developer Guide.
\n\n HeaderOrder
: The list of header names to match for. WAF creates a \n string that contains the ordered list of header names, from the headers in the web request, and then matches against that string.
If SearchString
includes alphabetic characters A-Z and a-z, note that the\n value is case sensitive.
\n If you're using the WAF API\n
\nSpecify a base64-encoded version of the value. The maximum length of the value before\n you base64-encode it is 200 bytes.
\nFor example, suppose the value of Type
is HEADER
and the value\n of Data
is User-Agent
. If you want to search the\n User-Agent
header for the value BadBot
, you base64-encode\n BadBot
using MIME base64-encoding and include the resulting value,\n QmFkQm90
, in the value of SearchString
.
\n If you're using the CLI or one of the Amazon Web Services SDKs\n
\nThe value that you want WAF to search for. The SDK automatically base64 encodes the\n value.
", "smithy.api#required": {} } }, @@ -2230,7 +2233,7 @@ "MatchScope": { "target": "com.amazonaws.wafv2#MapMatchScope", "traits": { - "smithy.api#documentation": "The parts of the cookies to inspect with the rule inspection criteria. If you specify\n All
, WAF inspects both keys and values.
The parts of the cookies to inspect with the rule inspection criteria. If you specify\n ALL
, WAF inspects both keys and values.
\n All
does not require a match to be found in the keys\n and a match to be found in the values. It requires a match to be found in the keys \n or the values or both. To require a match in the keys and in the values, use a logical AND
statement\n to combine two match rules, one that inspects the keys and another that inspects the values.
The client application domains that you want to use this API key for.
\nExample JSON: \"TokenDomains\": [\"abc.com\", \"store.abc.com\"]
\n
Public suffixes aren't allowed. For example, you can't use usa.gov
or co.uk
as token domains.
The client application domains that you want to use this API key for.
\nExample JSON: \"TokenDomains\": [\"abc.com\", \"store.abc.com\"]
\n
Public suffixes aren't allowed. For example, you can't use gov.au
or co.uk
as token domains.
Specifies the domains that WAF should accept in a web request token. This enables the use of tokens across multiple protected websites. When WAF provides a token, it uses the domain of the Amazon Web Services resource that the web ACL is protecting. If you don't specify a list of token domains, WAF accepts tokens only for the domain of the protected resource. With a token domain list, WAF accepts the resource's host domain plus all domains in the token domain list, including their prefixed subdomains.
\nExample JSON: \"TokenDomains\": { \"mywebsite.com\", \"myotherwebsite.com\" }
\n
Public suffixes aren't allowed. For example, you can't use usa.gov
or co.uk
as token domains.
Specifies the domains that WAF should accept in a web request token. This enables the use of tokens across multiple protected websites. When WAF provides a token, it uses the domain of the Amazon Web Services resource that the web ACL is protecting. If you don't specify a list of token domains, WAF accepts tokens only for the domain of the protected resource. With a token domain list, WAF accepts the resource's host domain plus all domains in the token domain list, including their prefixed subdomains.
\nExample JSON: \"TokenDomains\": { \"mywebsite.com\", \"myotherwebsite.com\" }
\n
Public suffixes aren't allowed. For example, you can't use gov.au
or co.uk
as token domains.
In a WebACL, this is the action that you want WAF to perform\n when a web request doesn't match any of the rules in the WebACL
. The default\n action must be a terminating action.
Deletes the specified API key.
\nAfter you delete a key, it can take up to 24 hours for WAF to disallow use of the key in all regions.
" + } + }, + "com.amazonaws.wafv2#DeleteAPIKeyRequest": { + "type": "structure", + "members": { + "Scope": { + "target": "com.amazonaws.wafv2#Scope", + "traits": { + "smithy.api#documentation": "Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.
\nTo work with CloudFront, you must also specify the Region US East (N. Virginia) as follows:
\nCLI - Specify the Region when you use the CloudFront scope: --scope=CLOUDFRONT --region=us-east-1
.
API and SDKs - For all calls, use the Region endpoint us-east-1.
\nThe encrypted API key that you want to delete.
", + "smithy.api#required": {} + } + } + }, + "traits": { + "smithy.api#input": {} + } + }, + "com.amazonaws.wafv2#DeleteAPIKeyResponse": { + "type": "structure", + "members": {}, + "traits": { + "smithy.api#output": {} + } + }, "com.amazonaws.wafv2#DeleteFirewallManagerRuleGroups": { "type": "operation", "input": { @@ -5203,7 +5264,7 @@ } ], "traits": { - "smithy.api#documentation": "Disassociates the specified regional application resource from any existing web ACL\n association. A resource can have at most one web ACL association. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.
\nFor Amazon CloudFront, don't use this call. Instead, use your CloudFront distribution configuration. To\n disassociate a web ACL, provide an empty web ACL ID in the CloudFront call\n UpdateDistribution
. For information, see UpdateDistribution in the Amazon CloudFront API Reference.
Disassociates the specified regional application resource from any existing web ACL\n association. A resource can have at most one web ACL association. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.
\nFor Amazon CloudFront, don't use this call. Instead, use your CloudFront distribution configuration. To\n disassociate a web ACL, provide an empty web ACL ID in the CloudFront call\n UpdateDistribution
. For information, see UpdateDistribution in the Amazon CloudFront API Reference.
\n Required permissions for customer-managed IAM policies\n
\nThis call requires permissions that are specific to the protected resource type. \n For details, see Permissions for DisassociateWebACL in the WAF Developer Guide.
" } }, "com.amazonaws.wafv2#DisassociateWebACLRequest": { @@ -6532,7 +6593,7 @@ } ], "traits": { - "smithy.api#documentation": "Retrieves the WebACL for the specified resource.
" + "smithy.api#documentation": "Retrieves the WebACL for the specified resource.
\nThis call uses GetWebACL
, to verify that your account has permission to access the retrieved web ACL. \n If you get an error that indicates that your account isn't authorized to perform wafv2:GetWebACL
on the resource, \n that error won't be included in your CloudTrail event history.
For Amazon CloudFront, don't use this call. Instead, call the CloudFront action\n GetDistributionConfig
. For information, see GetDistributionConfig in the Amazon CloudFront API Reference.
\n Required permissions for customer-managed IAM policies\n
\nThis call requires permissions that are specific to the protected resource type. \n For details, see Permissions for GetWebACLForResource in the WAF Developer Guide.
" } }, "com.amazonaws.wafv2#GetWebACLForResourceRequest": { @@ -6767,7 +6828,7 @@ "MatchScope": { "target": "com.amazonaws.wafv2#MapMatchScope", "traits": { - "smithy.api#documentation": "The parts of the headers to match with the rule inspection criteria. If you specify\n All
, WAF inspects both keys and values.
The parts of the headers to match with the rule inspection criteria. If you specify\n ALL
, WAF inspects both keys and values.
\n All
does not require a match to be found in the keys\n and a match to be found in the values. It requires a match to be found in the keys \n or the values or both. To require a match in the keys and in the values, use a logical AND
statement\n to combine two match rules, one that inspects the keys and another that inspects the values.
The parts of the JSON to match against using the MatchPattern
. If you\n specify All
, WAF matches against keys and values.
The parts of the JSON to match against using the MatchPattern
. If you\n specify ALL
, WAF matches against keys and values.
\n All
does not require a match to be found in the keys\n and a match to be found in the values. It requires a match to be found in the keys \n or the values or both. To require a match in the keys and in the values, use a logical AND
statement\n to combine two match rules, one that inspects the keys and another that inspects the values.
Retrieves an array of the Amazon Resource Names (ARNs) for the regional resources that\n are associated with the specified web ACL. If you want the list of Amazon CloudFront resources, use\n the CloudFront call ListDistributionsByWebACLId
.
Retrieves an array of the Amazon Resource Names (ARNs) for the regional resources that\n are associated with the specified web ACL.
\nFor Amazon CloudFront, don't use this call. Instead, use the CloudFront call\n ListDistributionsByWebACLId
. For information, see ListDistributionsByWebACLId\n in the Amazon CloudFront API Reference.
\n Required permissions for customer-managed IAM policies\n
\nThis call requires permissions that are specific to the protected resource type. \n For details, see Permissions for ListResourcesForWebACL in the WAF Developer Guide.
" } }, "com.amazonaws.wafv2#ListResourcesForWebACLRequest": { @@ -11785,7 +11846,7 @@ } ], "traits": { - "smithy.api#documentation": "Updates the specified IPSet.
\nThis operation completely replaces the mutable specifications that you already have for the IP set with the ones that you provide to this call.
\nTo modify an IP set, do the following:
\nRetrieve it by calling GetIPSet\n
\nUpdate its settings as needed
\nProvide the complete IP set specification to this call
\nWhen you make changes to web ACLs or web ACL components, like rules and rule groups, WAF propagates the changes everywhere that the web ACL and its components are stored and used. Your changes are applied within seconds, but there might be a brief period of inconsistency when the changes have arrived in some places and not in others. So, for example, if you change a rule action setting, the action might be the old action in one area and the new action in another area. Or if you add an IP address to an IP set used in a blocking rule, the new address might briefly be blocked in one area while still allowed in another. This temporary inconsistency can occur when you first associate a web ACL with an Amazon Web Services resource and when you change a web ACL that is already associated with a resource. Generally, any inconsistencies of this type last only a few seconds.
" + "smithy.api#documentation": "Updates the specified IPSet.
\nThis operation completely replaces the mutable specifications that you already have for the IP set with the ones that you provide to this call.
\nTo modify an IP set, do the following:
\nRetrieve it by calling GetIPSet\n
\nUpdate its settings as needed
\nProvide the complete IP set specification to this call
\n\n Temporary inconsistencies during updates\n
\nWhen you create or change a web ACL or other WAF resources, the changes take a small amount of time to propagate to all areas where the resources are stored. The propagation time can be from a few seconds to a number of minutes.
\nThe following are examples of the temporary inconsistencies that you might notice during change propagation:
\nAfter you create a web ACL, if you try to associate it with a resource, you might get an exception indicating that the web ACL is unavailable.
\nAfter you add a rule group to a web ACL, the new rule group rules might be in effect in one area where the web ACL is used and not in another.
\nAfter you change a rule action setting, you might see the old action in some places and the new action in others.
\nAfter you add an IP address to an IP set that is in use in a blocking rule, the new address might be blocked in one area while still allowed in another.
\nUpdates the specified RegexPatternSet.
\nThis operation completely replaces the mutable specifications that you already have for the regex pattern set with the ones that you provide to this call.
\nTo modify a regex pattern set, do the following:
\nRetrieve it by calling GetRegexPatternSet\n
\nUpdate its settings as needed
\nProvide the complete regex pattern set specification to this call
\nWhen you make changes to web ACLs or web ACL components, like rules and rule groups, WAF propagates the changes everywhere that the web ACL and its components are stored and used. Your changes are applied within seconds, but there might be a brief period of inconsistency when the changes have arrived in some places and not in others. So, for example, if you change a rule action setting, the action might be the old action in one area and the new action in another area. Or if you add an IP address to an IP set used in a blocking rule, the new address might briefly be blocked in one area while still allowed in another. This temporary inconsistency can occur when you first associate a web ACL with an Amazon Web Services resource and when you change a web ACL that is already associated with a resource. Generally, any inconsistencies of this type last only a few seconds.
" + "smithy.api#documentation": "Updates the specified RegexPatternSet.
\nThis operation completely replaces the mutable specifications that you already have for the regex pattern set with the ones that you provide to this call.
\nTo modify a regex pattern set, do the following:
\nRetrieve it by calling GetRegexPatternSet\n
\nUpdate its settings as needed
\nProvide the complete regex pattern set specification to this call
\n\n Temporary inconsistencies during updates\n
\nWhen you create or change a web ACL or other WAF resources, the changes take a small amount of time to propagate to all areas where the resources are stored. The propagation time can be from a few seconds to a number of minutes.
\nThe following are examples of the temporary inconsistencies that you might notice during change propagation:
\nAfter you create a web ACL, if you try to associate it with a resource, you might get an exception indicating that the web ACL is unavailable.
\nAfter you add a rule group to a web ACL, the new rule group rules might be in effect in one area where the web ACL is used and not in another.
\nAfter you change a rule action setting, you might see the old action in some places and the new action in others.
\nAfter you add an IP address to an IP set that is in use in a blocking rule, the new address might be blocked in one area while still allowed in another.
\nUpdates the specified RuleGroup.
\nThis operation completely replaces the mutable specifications that you already have for the rule group with the ones that you provide to this call.
\nTo modify a rule group, do the following:
\nRetrieve it by calling GetRuleGroup\n
\nUpdate its settings as needed
\nProvide the complete rule group specification to this call
\nWhen you make changes to web ACLs or web ACL components, like rules and rule groups, WAF propagates the changes everywhere that the web ACL and its components are stored and used. Your changes are applied within seconds, but there might be a brief period of inconsistency when the changes have arrived in some places and not in others. So, for example, if you change a rule action setting, the action might be the old action in one area and the new action in another area. Or if you add an IP address to an IP set used in a blocking rule, the new address might briefly be blocked in one area while still allowed in another. This temporary inconsistency can occur when you first associate a web ACL with an Amazon Web Services resource and when you change a web ACL that is already associated with a resource. Generally, any inconsistencies of this type last only a few seconds.
\nA rule group defines a collection of rules to inspect and control web requests that you can use in a WebACL. When you create a rule group, you define an immutable capacity limit. If you update a rule group, you must stay within the capacity. This allows others to reuse the rule group with confidence in its capacity requirements.
" + "smithy.api#documentation": "Updates the specified RuleGroup.
\nThis operation completely replaces the mutable specifications that you already have for the rule group with the ones that you provide to this call.
\nTo modify a rule group, do the following:
\nRetrieve it by calling GetRuleGroup\n
\nUpdate its settings as needed
\nProvide the complete rule group specification to this call
\nA rule group defines a collection of rules to inspect and control web requests that you can use in a WebACL. When you create a rule group, you define an immutable capacity limit. If you update a rule group, you must stay within the capacity. This allows others to reuse the rule group with confidence in its capacity requirements.
\n\n Temporary inconsistencies during updates\n
\nWhen you create or change a web ACL or other WAF resources, the changes take a small amount of time to propagate to all areas where the resources are stored. The propagation time can be from a few seconds to a number of minutes.
\nThe following are examples of the temporary inconsistencies that you might notice during change propagation:
\nAfter you create a web ACL, if you try to associate it with a resource, you might get an exception indicating that the web ACL is unavailable.
\nAfter you add a rule group to a web ACL, the new rule group rules might be in effect in one area where the web ACL is used and not in another.
\nAfter you change a rule action setting, you might see the old action in some places and the new action in others.
\nAfter you add an IP address to an IP set that is in use in a blocking rule, the new address might be blocked in one area while still allowed in another.
\nUpdates the specified WebACL. While updating a web ACL, WAF provides\n continuous coverage to the resources that you have associated with the web ACL.
\nThis operation completely replaces the mutable specifications that you already have for the web ACL with the ones that you provide to this call.
\nTo modify a web ACL, do the following:
\nRetrieve it by calling GetWebACL\n
\nUpdate its settings as needed
\nProvide the complete web ACL specification to this call
\nWhen you make changes to web ACLs or web ACL components, like rules and rule groups, WAF propagates the changes everywhere that the web ACL and its components are stored and used. Your changes are applied within seconds, but there might be a brief period of inconsistency when the changes have arrived in some places and not in others. So, for example, if you change a rule action setting, the action might be the old action in one area and the new action in another area. Or if you add an IP address to an IP set used in a blocking rule, the new address might briefly be blocked in one area while still allowed in another. This temporary inconsistency can occur when you first associate a web ACL with an Amazon Web Services resource and when you change a web ACL that is already associated with a resource. Generally, any inconsistencies of this type last only a few seconds.
\nA web ACL defines a collection of rules to use to inspect and control web requests. Each rule has a statement that defines what to look for in web requests and an action that WAF applies to requests that match the statement. In the web ACL, you assign a default action to take (allow, block) for any request that does not match any of the rules. The rules in a web ACL can be a combination of the types Rule, RuleGroup, and managed rule group. You can associate a web ACL with one or more Amazon Web Services resources to protect. The resources can be an Amazon CloudFront distribution, an Amazon API Gateway REST API, an Application Load Balancer, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.
" + "smithy.api#documentation": "Updates the specified WebACL. While updating a web ACL, WAF provides\n continuous coverage to the resources that you have associated with the web ACL.
\nThis operation completely replaces the mutable specifications that you already have for the web ACL with the ones that you provide to this call.
\nTo modify a web ACL, do the following:
\nRetrieve it by calling GetWebACL\n
\nUpdate its settings as needed
\nProvide the complete web ACL specification to this call
\nA web ACL defines a collection of rules to use to inspect and control web requests. Each rule has a statement that defines what to look for in web requests and an action that WAF applies to requests that match the statement. In the web ACL, you assign a default action to take (allow, block) for any request that does not match any of the rules. The rules in a web ACL can be a combination of the types Rule, RuleGroup, and managed rule group. You can associate a web ACL with one or more Amazon Web Services resources to protect. The resources can be an Amazon CloudFront distribution, an Amazon API Gateway REST API, an Application Load Balancer, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance.
\n\n Temporary inconsistencies during updates\n
\nWhen you create or change a web ACL or other WAF resources, the changes take a small amount of time to propagate to all areas where the resources are stored. The propagation time can be from a few seconds to a number of minutes.
\nThe following are examples of the temporary inconsistencies that you might notice during change propagation:
\nAfter you create a web ACL, if you try to associate it with a resource, you might get an exception indicating that the web ACL is unavailable.
\nAfter you add a rule group to a web ACL, the new rule group rules might be in effect in one area where the web ACL is used and not in another.
\nAfter you change a rule action setting, you might see the old action in some places and the new action in others.
\nAfter you add an IP address to an IP set that is in use in a blocking rule, the new address might be blocked in one area while still allowed in another.
\nSpecifies the domains that WAF should accept in a web request token. This enables the use of tokens across multiple protected websites. When WAF provides a token, it uses the domain of the Amazon Web Services resource that the web ACL is protecting. If you don't specify a list of token domains, WAF accepts tokens only for the domain of the protected resource. With a token domain list, WAF accepts the resource's host domain plus all domains in the token domain list, including their prefixed subdomains.
\nExample JSON: \"TokenDomains\": { \"mywebsite.com\", \"myotherwebsite.com\" }
\n
Public suffixes aren't allowed. For example, you can't use usa.gov
or co.uk
as token domains.
Specifies the domains that WAF should accept in a web request token. This enables the use of tokens across multiple protected websites. When WAF provides a token, it uses the domain of the Amazon Web Services resource that the web ACL is protecting. If you don't specify a list of token domains, WAF accepts tokens only for the domain of the protected resource. With a token domain list, WAF accepts the resource's host domain plus all domains in the token domain list, including their prefixed subdomains.
\nExample JSON: \"TokenDomains\": { \"mywebsite.com\", \"myotherwebsite.com\" }
\n
Public suffixes aren't allowed. For example, you can't use gov.au
or co.uk
as token domains.