Merge pull request #10072 from lvyangyang/automated-cherry-pick-of-#10041-upstream-release-3.7

Automated cherry pick of #10041: feat(region): aws elasticahe

go.mod

@@ -26,7 +26,7 @@ require (
 	github.com/anacrolix/torrent v0.0.0-20181129073333-cc531b8c4a80
 	github.com/aokoli/goutils v1.0.1
 	github.com/apache/thrift v0.12.0 // indirect
-	github.com/aws/aws-sdk-go v1.30.29
+	github.com/aws/aws-sdk-go v1.36.31
 	github.com/baiyubin/aliyun-sts-go-sdk v0.0.0-20180326062324-cfa1a18b161f // indirect
 	github.com/beevik/etree v1.1.0 // indirect
 	github.com/benbjohnson/clock v1.0.0
@@ -122,10 +122,10 @@ require (
 	go.etcd.io/etcd v0.5.0-alpha.5.0.20200819165624-17cef6e3e9d5
 	go.uber.org/atomic v1.4.0 // indirect
 	golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9
-	golang.org/x/net v0.0.0-20200707034311-ab3426394381
+	golang.org/x/net v0.0.0-20201110031124-69a78807bb2b
 	golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6
 	golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e
-	golang.org/x/sys v0.0.0-20200622214017-ed371f2e16b4
+	golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f
 	golang.org/x/text v0.3.3
 	golang.org/x/tools v0.0.0-20200515220128-d3bf790afa53 // indirect
 	golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543

go.sum

@@ -133,8 +133,8 @@ github.com/aokoli/goutils v1.0.1 h1:7fpzNGoJ3VA8qcrm++XEE1QUe0mIwNeLa02Nwq7RDkg=
 github.com/aokoli/goutils v1.0.1/go.mod h1:SijmP0QR8LtwsmDs8Yii5Z/S4trXFGFC2oO5g9DP+DQ=
 github.com/apache/thrift v0.12.0 h1:pODnxUFNcjP9UTLZGTdeh+j16A8lJbRvD3rOtrk/7bs=
 github.com/apache/thrift v0.12.0/go.mod h1:cp2SuWMxlEZw2r+iP2GNCdIi4C1qmUzdZFSVb+bacwQ=
-github.com/aws/aws-sdk-go v1.30.29 h1:NXNqBS9hjOCpDL8SyCyl38gZX3LLLunKOJc5E7vJ8P0=
-github.com/aws/aws-sdk-go v1.30.29/go.mod h1:5zCpMtNQVjRREroY7sYe8lOMRSxkhG6MZveU8YkpAk0=
+github.com/aws/aws-sdk-go v1.36.31 h1:BMVngapDGAfLBVEVzaSIw3fmJdWx7jOvhLCXgRXbXQI=
+github.com/aws/aws-sdk-go v1.36.31/go.mod h1:hcU610XS61/+aQV88ixoOzUoG7v3b31pl2zKMmprdro=
 github.com/baiyubin/aliyun-sts-go-sdk v0.0.0-20180326062324-cfa1a18b161f h1:ZNv7On9kyUzm7fvRZumSyy/IUiSC7AzL0I1jKKtwooA=
 github.com/baiyubin/aliyun-sts-go-sdk v0.0.0-20180326062324-cfa1a18b161f/go.mod h1:AuiFmCCPBSrqvVMvuqFuk0qogytodnVFVSN5CeJB8Gc=
 github.com/beevik/etree v1.1.0 h1:T0xke/WvNtMoCqgzPhkX2r4rjY3GDZFi+FjpRZY2Jbs=
@@ -373,8 +373,10 @@ github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANyt
 github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
 github.com/jmespath/go-jmespath v0.0.0-20180206201540-c2b33e8439af h1:pmfjZENx5imkbgOkpRUYLnmbU7UEFbjtDA2hxJ1ichM=
 github.com/jmespath/go-jmespath v0.0.0-20180206201540-c2b33e8439af/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
-github.com/jmespath/go-jmespath v0.3.0 h1:OS12ieG61fsCg5+qLJ+SsW9NicxNkg3b25OyT2yCeUc=
-github.com/jmespath/go-jmespath v0.3.0/go.mod h1:9QtRXoHjLGCJ5IBSaohpXITPlowMeeYCZ7fLUTSywik=
+github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
+github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
+github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
+github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
 github.com/jonboulle/clockwork v0.1.0 h1:VKV+ZcuP6l3yW9doeqz6ziZGgcynBVQO+obU0+0hcPo=
 github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo=
 github.com/jsimonetti/rtnetlink v0.0.0-20190606172950-9527aa82566a/go.mod h1:Oz+70psSo5OFh8DBl0Zv2ACw7Esh6pPUphlvZG9x7uw=
@@ -703,12 +705,13 @@ golang.org/x/net v0.0.0-20191003171128-d98b1b443823/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20191007182048-72f939374954/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553 h1:efeOvDhwQ29Dj3SdAV/MJf8oukgn+8D8WgaCaRMchF8=
 golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b h1:0mm1VjtFUOIlE1SbDlwjYaDxZVDP2S5ou6y0gSgXHu8=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20200707034311-ab3426394381 h1:VXak5I6aEWmAXeQjA+QSZzlgNrpq9mjcfDemuexIKsU=
 golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
+golang.org/x/net v0.0.0-20201110031124-69a78807bb2b h1:uwuIcX0g4Yl1NC5XAz37xsr2lTtcqevgzYNVt49waME=
+golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -754,6 +757,8 @@ golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200622214017-ed371f2e16b4 h1:5/PjkGUjvEU5Gl6BxmvKRPpqo2uNMv4rcHBMwzk/st8=
 golang.org/x/sys v0.0.0-20200622214017-ed371f2e16b4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f h1:+Nyd8tzPX9R7BWHguqsrbFdRx3WQ/1ib8I44HXV5yTA=
+golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2 h1:tW2bmiBqwgJj/UpqtC8EpXEZVYOwU0yG4iWbprSVAcs=

pkg/apis/compute/elasticcache_const.go

@@ -42,18 +42,22 @@ const (
 	ELASTIC_CACHE_STATUS_SSLMODIFYING          = "sslmodifying"          //（SSL变更中）
 	ELASTIC_CACHE_STATUS_MAJORVERSIONUPGRADING = "majorversionupgrading" //（大版本升级中，可正常访问）
 	ELASTIC_CACHE_STATUS_UNKNOWN               = "unknown"               //（未知状态）
+	ELASTIC_CACHE_STATUS_DELETING              = "deleting"              // (删除)
+	ELASTIC_CACHE_STATUS_SNAPSHOTTING          = "snapshotting"          //（快照）
 	ELASTIC_CACHE_STATUS_SYNCING               = "syncing"               //（同步中）
 	ELASTIC_CACHE_STATUS_SYNC_FAILED           = "sync_failed"           //（同步失败）
 	ELASTIC_CACHE_RENEWING                     = "renewing"              //（续费中）
 	ELASTIC_CACHE_RENEW_FAILED                 = "renew_failed"          //（续费失败）
 	ELASTIC_CACHE_SET_AUTO_RENEW               = "set_auto_renew"        //（设置自动续费）
 	ELASTIC_CACHE_SET_AUTO_RENEW_FAILED        = "set_auto_renew_failed" //（设置自动续费失败）
+
 )
 
 const (
 	ELASTIC_CACHE_ACCOUNT_STATUS_AVAILABLE     = "available"     // 正常可用
 	ELASTIC_CACHE_ACCOUNT_STATUS_UNAVAILABLE   = "unavailable"   // 不可用
 	ELASTIC_CACHE_ACCOUNT_STATUS_CREATING      = "creating"      // 创建中
+	ELASTIC_CACHE_ACCOUNT_STATUS_MODIFYING     = "modifying"     // 修改中
 	ELASTIC_CACHE_ACCOUNT_STATUS_CREATE_FAILED = "create_failed" //（创建失败）
 	ELASTIC_CACHE_ACCOUNT_STATUS_DELETING      = "deleting"      // 删除中
 	ELASTIC_CACHE_ACCOUNT_STATUS_DELETE_FAILED = "delete_failed" // 删除失败
@@ -78,11 +82,14 @@ const (
 
 const (
 	ELASTIC_CACHE_BACKUP_STATUS_CREATING       = "creating" // 备份中
+	ELASTIC_CACHE_BACKUP_STATUS_RESTORING      = "restoring"
+	ELASTIC_CACHE_BACKUP_STATUS_COPYING        = "copying"
 	ELASTIC_CACHE_BACKUP_STATUS_CREATE_EXPIRED = "expired"  //（备份文件已过期）
 	ELASTIC_CACHE_BACKUP_STATUS_CREATE_DELETED = "deleted"  //（备份文件已删除）
 	ELASTIC_CACHE_BACKUP_STATUS_DELETING       = "deleting" // 删除中
 	ELASTIC_CACHE_BACKUP_STATUS_SUCCESS        = "success"  // 备份成功
 	ELASTIC_CACHE_BACKUP_STATUS_FAILED         = "failed"   // 备份失败
+	ELASTIC_CACHE_BACKUP_STATUS_UNKNOWN        = "unknown"  // 未知
 )
 
 const (
@@ -118,6 +125,15 @@ const (
 	ELASTIC_CACHE_ARCH_TYPE_RWSPLIT = "rwsplit" // 读写分离
 )
 
+const (
+	ELASTIC_CACHE_NODE_TYPE_SINGLE = "single"
+	ELASTIC_CACHE_NODE_TYPE_DOUBLE = "double"
+	ELASTIC_CACHE_NODE_TYPE_THREE  = "three"
+	ELASTIC_CACHE_NODE_TYPE_FOUR   = "four"
+	ELASTIC_CACHE_NODE_TYPE_FIVE   = "five"
+	ELASTIC_CACHE_NODE_TYPE_SIX    = "six"
+)
+
 type ElasticcacheListInput struct {
 	apis.VirtualResourceListInput
 	apis.ExternalizedResourceBaseListInput

pkg/multicloud/aws/aws.go

@@ -31,6 +31,7 @@ import (
 	"github.com/aws/aws-sdk-go/private/protocol/query"
 	"github.com/aws/aws-sdk-go/service/cloudwatch"
 	"github.com/aws/aws-sdk-go/service/ec2"
+	"github.com/aws/aws-sdk-go/service/elasticache"
 	"github.com/aws/aws-sdk-go/service/s3"
 
 	"yunion.io/x/log"
@@ -242,6 +243,15 @@ func (client *SAwsClient) getAwsSession(regionId string) (*session.Session, erro
 	return s, nil
 }
 
+func (region *SRegion) getAwsElasticacheClient() (*elasticache.ElastiCache, error) {
+	session, err := region.getAwsSession()
+	if err != nil {
+		return nil, errors.Wrap(err, "client.getDefaultSession")
+	}
+	session.ClientConfig(ELASTICACHE_SERVICE_NAME)
+	return elasticache.New(session), nil
+}
+
 func (client *SAwsClient) getAwsRoute53Session() (*session.Session, error) {
 	session, err := client.getDefaultSession()
 	if err != nil {
@@ -526,7 +536,7 @@ func (self *SAwsClient) GetCapabilities() []string {
 		cloudprovider.CLOUD_CAPABILITY_LOADBALANCER,
 		cloudprovider.CLOUD_CAPABILITY_OBJECTSTORE,
 		cloudprovider.CLOUD_CAPABILITY_RDS,
-		// cloudprovider.CLOUD_CAPABILITY_CACHE,
+		cloudprovider.CLOUD_CAPABILITY_CACHE,
 		// cloudprovider.CLOUD_CAPABILITY_EVENT,
 		cloudprovider.CLOUD_CAPABILITY_CLOUDID,
 		cloudprovider.CLOUD_CAPABILITY_DNSZONE,

pkg/multicloud/aws/elasticache_instance.go

@@ -0,0 +1,701 @@
+// Copyright 2019 Yunion
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package aws
+
+import (
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/aws/aws-sdk-go/service/elasticache"
+
+	"yunion.io/x/jsonutils"
+	"yunion.io/x/log"
+	"yunion.io/x/pkg/errors"
+
+	billingapi "yunion.io/x/onecloud/pkg/apis/billing"
+	api "yunion.io/x/onecloud/pkg/apis/compute"
+	"yunion.io/x/onecloud/pkg/cloudprovider"
+	"yunion.io/x/onecloud/pkg/multicloud"
+	"yunion.io/x/onecloud/pkg/util/billing"
+)
+
+func (region *SRegion) DescribeElasticacheReplicationGroups(Id string) ([]*elasticache.ReplicationGroup, error) {
+	ecClient, err := region.getAwsElasticacheClient()
+	if err != nil {
+		return nil, errors.Wrap(err, "client.getAwsElasticacheClient")
+	}
+
+	input := elasticache.DescribeReplicationGroupsInput{}
+
+	replicaGroup := []*elasticache.ReplicationGroup{}
+
+	marker := ""
+	maxrecords := (int64)(100)
+	input.MaxRecords = &maxrecords
+
+	if len(Id) > 0 {
+		input.ReplicationGroupId = &Id
+	}
+
+	for {
+		if len(marker) >= 0 {
+			input.Marker = &marker
+		}
+		out, err := ecClient.DescribeReplicationGroups(&input)
+		if err != nil {
+			return nil, errors.Wrap(err, "ecClient.DescribeReplicationGroups")
+		}
+		replicaGroup = append(replicaGroup, out.ReplicationGroups...)
+
+		if out.Marker != nil && len(*out.Marker) > 0 {
+			marker = *out.Marker
+		} else {
+			break
+		}
+	}
+
+	return replicaGroup, nil
+}
+
+func (region *SRegion) GetElasticaches() ([]SElasticache, error) {
+	replicaGroups, err := region.DescribeElasticacheReplicationGroups("")
+	if err != nil {
+		return nil, errors.Wrap(err, " region.DescribeElasticacheReplicationGroups")
+	}
+	result := []SElasticache{}
+	for i := range replicaGroups {
+		result = append(result, SElasticache{region: region, replicaGroup: replicaGroups[i]})
+	}
+	return result, nil
+}
+
+func (region *SRegion) GetIElasticcaches() ([]cloudprovider.ICloudElasticcache, error) {
+	sElasticahes, err := region.GetElasticaches()
+	if err != nil {
+		return nil, errors.Wrap(err, "region.GetSElasticaches()")
+	}
+	result := []cloudprovider.ICloudElasticcache{}
+	for i := range sElasticahes {
+		result = append(result, &sElasticahes[i])
+	}
+	return result, nil
+}
+
+func (region *SRegion) GetSElasticacheById(Id string) (*SElasticache, error) {
+	replicaGroups, err := region.DescribeElasticacheReplicationGroups(Id)
+	if err != nil {
+		return nil, errors.Wrap(err, " region.DescribeElasticacheReplicationGroups")
+	}
+	if len(replicaGroups) == 0 {
+		return nil, cloudprovider.ErrNotFound
+	}
+	if len(replicaGroups) > 1 {
+		return nil, cloudprovider.ErrDuplicateId
+	}
+	return &SElasticache{region: region, replicaGroup: replicaGroups[0]}, nil
+}
+
+func (region *SRegion) GetIElasticcacheById(id string) (cloudprovider.ICloudElasticcache, error) {
+	sElasticache, err := region.GetSElasticacheById(id)
+	if err != nil {
+		return nil, errors.Wrapf(err, "region.GetSElasticacheById(%s)", id)
+	}
+	return sElasticache, nil
+}
+
+func (region *SRegion) DescribeElasticacheClusters() ([]*elasticache.CacheCluster, error) {
+	ecClient, err := region.getAwsElasticacheClient()
+	if err != nil {
+		return nil, errors.Wrap(err, "client.getAwsElasticacheClient")
+	}
+
+	input := elasticache.DescribeCacheClustersInput{}
+
+	clusters := []*elasticache.CacheCluster{}
+	marker := ""
+	maxrecords := (int64)(100)
+	input.MaxRecords = &maxrecords
+
+	for {
+		if len(marker) >= 0 {
+			input.Marker = &marker
+		}
+		out, err := ecClient.DescribeCacheClusters(&input)
+		if err != nil {
+			return nil, errors.Wrap(err, "ecClient.DescribeCacheClusters")
+		}
+		clusters = append(clusters, out.CacheClusters...)
+
+		if out.Marker != nil && len(*out.Marker) > 0 {
+			marker = *out.Marker
+		} else {
+			break
+		}
+	}
+
+	return clusters, nil
+}
+
+func (region *SRegion) DescribeCacheSubnetGroups(Id string) ([]*elasticache.CacheSubnetGroup, error) {
+	ecClient, err := region.getAwsElasticacheClient()
+	if err != nil {
+		return nil, errors.Wrap(err, "client.getAwsElasticacheClient")
+	}
+	input := elasticache.DescribeCacheSubnetGroupsInput{}
+	subnetGroups := []*elasticache.CacheSubnetGroup{}
+
+	marker := ""
+	maxrecords := (int64)(100)
+	input.MaxRecords = &maxrecords
+	if len(Id) > 0 {
+		input.CacheSubnetGroupName = &Id
+	}
+	for {
+		if len(marker) >= 0 {
+			input.Marker = &marker
+		}
+		out, err := ecClient.DescribeCacheSubnetGroups(&input)
+		if err != nil {
+			return nil, errors.Wrap(err, "ecClient.DescribeCacheSubnetGroups")
+		}
+		subnetGroups = append(subnetGroups, out.CacheSubnetGroups...)
+
+		if out.Marker != nil && len(*out.Marker) > 0 {
+			marker = *out.Marker
+		} else {
+			break
+		}
+	}
+
+	return subnetGroups, nil
+}
+
+type SElasticache struct {
+	multicloud.SElasticcacheBase
+
+	region        *SRegion
+	replicaGroup  *elasticache.ReplicationGroup
+	cacheClusters []*elasticache.CacheCluster
+	subnetGroup   *elasticache.CacheSubnetGroup
+}
+
+func (self *SElasticache) GetId() string {
+	return *self.replicaGroup.ReplicationGroupId
+}
+
+func (self *SElasticache) GetName() string {
+	return *self.replicaGroup.ReplicationGroupId
+}
+
+func (self *SElasticache) GetGlobalId() string {
+	return self.GetId()
+}
+
+func (self *SElasticache) GetStatus() string {
+	if self.replicaGroup.Status == nil {
+		return api.ELASTIC_CACHE_STATUS_UNKNOWN
+	}
+	// creating, available, modifying, deleting, create-failed, snapshotting
+	switch *self.replicaGroup.Status {
+	case "creating":
+		return api.ELASTIC_CACHE_STATUS_DEPLOYING
+	case "available":
+		return api.ELASTIC_CACHE_STATUS_RUNNING
+	case "modifying":
+		return api.ELASTIC_CACHE_STATUS_CHANGING
+	case "deleting":
+		return api.ELASTIC_CACHE_STATUS_DELETING
+	case "create-failed":
+		return api.ELASTIC_CACHE_STATUS_CREATE_FAILED
+	case "snapshotting":
+		return api.ELASTIC_CACHE_STATUS_SNAPSHOTTING
+	default:
+		return api.ELASTIC_CACHE_STATUS_UNKNOWN
+	}
+}
+
+func (self *SElasticache) Refresh() error {
+	if self.replicaGroup.ReplicationGroupId == nil {
+		return errors.Wrap(cloudprovider.ErrNotFound, "replicationGroupId not found")
+	}
+	replica, err := self.region.DescribeElasticacheReplicationGroups(*self.replicaGroup.ReplicationGroupId)
+
+	if err != nil {
+		return errors.Wrapf(err, "self.region.DescribeElasticacheReplicationGroups(%s)", *self.replicaGroup.ReplicationGroupId)
+	}
+
+	if len(replica) == 0 {
+		return cloudprovider.ErrNotFound
+	}
+	if len(replica) > 1 {
+		return cloudprovider.ErrDuplicateId
+	}
+
+	self.replicaGroup = replica[0]
+	self.cacheClusters = nil
+	self.subnetGroup = nil
+
+	return nil
+}
+
+func (self *SElasticache) GetBillingType() string {
+	return billingapi.BILLING_TYPE_POSTPAID
+}
+
+func (self *SElasticache) GetCreatedAt() time.Time {
+	return time.Time{}
+}
+
+func (self *SElasticache) GetExpiredAt() time.Time {
+	return time.Time{}
+}
+
+func (self *SElasticache) fetchClusters() error {
+	if self.cacheClusters != nil {
+		return nil
+	}
+	clusters, err := self.region.DescribeElasticacheClusters()
+	if err != nil {
+		return errors.Wrap(err, "self.region.DescribeElasticacheClusters")
+	}
+	self.cacheClusters = []*elasticache.CacheCluster{}
+	for i := range clusters {
+		if clusters[i].ReplicationGroupId != nil && *clusters[i].ReplicationGroupId == self.GetId() {
+			self.cacheClusters = append(self.cacheClusters, clusters[i])
+		}
+	}
+	return nil
+}
+
+func (self *SElasticache) GetInstanceType() string {
+	if self.replicaGroup.CacheNodeType != nil {
+		return *self.replicaGroup.CacheNodeType
+	}
+	return ""
+}
+
+func (self *SElasticache) GetCapacityMB() int {
+	return 0
+}
+
+func (self *SElasticache) GetArchType() string {
+	if self.replicaGroup.ClusterEnabled != nil && *self.replicaGroup.ClusterEnabled == true {
+		return api.ELASTIC_CACHE_ARCH_TYPE_CLUSTER
+	}
+
+	self.fetchClusters()
+	if len(self.cacheClusters) > 1 {
+		return api.ELASTIC_CACHE_ARCH_TYPE_RWSPLIT
+	}
+
+	return api.ELASTIC_CACHE_ARCH_TYPE_SINGLE
+}
+
+func (self *SElasticache) GetNodeType() string {
+	nodeGroupNums := 1
+	for _, nodeGroup := range self.replicaGroup.NodeGroups {
+		if nodeGroup != nil {
+			nodeGroupNums = len(nodeGroup.NodeGroupMembers)
+			break
+		}
+	}
+	switch nodeGroupNums {
+	case 1:
+		return api.ELASTIC_CACHE_NODE_TYPE_SINGLE
+	case 2:
+		return api.ELASTIC_CACHE_NODE_TYPE_DOUBLE
+	case 3:
+		return api.ELASTIC_CACHE_NODE_TYPE_THREE
+	case 4:
+		return api.ELASTIC_CACHE_NODE_TYPE_FOUR
+	case 5:
+		return api.ELASTIC_CACHE_NODE_TYPE_FIVE
+	case 6:
+		return api.ELASTIC_CACHE_NODE_TYPE_SIX
+	}
+
+	return strconv.Itoa(nodeGroupNums)
+}
+
+func (self *SElasticache) GetEngine() string {
+	self.fetchClusters()
+	for _, cluster := range self.cacheClusters {
+		if cluster != nil && cluster.Engine != nil {
+			return *cluster.Engine
+		}
+	}
+	return ""
+}
+
+func (self *SElasticache) GetEngineVersion() string {
+	self.fetchClusters()
+	for _, cluster := range self.cacheClusters {
+		if cluster != nil && cluster.EngineVersion != nil {
+			return *cluster.EngineVersion
+		}
+	}
+	return ""
+}
+
+func (self *SElasticache) fetchSubnetGroup() error {
+	if self.subnetGroup != nil {
+		return nil
+	}
+	err := self.fetchClusters()
+	if err != nil {
+		return errors.Wrap(err, "self.fetchClusters()")
+	}
+
+	subnetGroupName := ""
+	for _, cluster := range self.cacheClusters {
+		if cluster != nil && cluster.CacheSubnetGroupName != nil {
+			subnetGroupName = *cluster.CacheSubnetGroupName
+		}
+	}
+
+	if len(subnetGroupName) == 0 {
+		return cloudprovider.ErrNotFound
+	}
+
+	subnetGroup, err := self.region.DescribeCacheSubnetGroups(subnetGroupName)
+	if err != nil {
+		return errors.Wrapf(err, "self.region.DescribeCacheSubnetGroups(%s)", subnetGroupName)
+	}
+
+	if len(subnetGroup) == 0 {
+		return errors.Wrapf(cloudprovider.ErrNotFound, "subnetGroup %s not found", subnetGroupName)
+	}
+	if len(subnetGroup) > 1 {
+		return cloudprovider.ErrDuplicateId
+	}
+
+	self.subnetGroup = subnetGroup[0]
+	return nil
+}
+
+func (self *SElasticache) GetVpcId() string {
+	err := self.fetchSubnetGroup()
+	if err != nil {
+		log.Errorf("Error:%s,self.fetchSubnetGroup()", err)
+		return ""
+	}
+	if self.subnetGroup != nil && self.subnetGroup.VpcId != nil {
+		return *self.subnetGroup.VpcId
+	}
+	return ""
+}
+
+func (self *SElasticache) GetZoneId() string {
+	return ""
+}
+
+func (self *SElasticache) GetNetworkType() string {
+	if len(self.GetVpcId()) > 0 {
+		return api.LB_NETWORK_TYPE_VPC
+	}
+	return api.LB_NETWORK_TYPE_CLASSIC
+}
+
+func (self *SElasticache) GetNetworkId() string {
+	return ""
+}
+
+// cluster mode(shard) 只有配置endpoint,no cluster mode 有primary/readonly endpoint
+func (self *SElasticache) GetPrivateDNS() string {
+	for _, nodeGroup := range self.replicaGroup.NodeGroups {
+		if nodeGroup != nil && nodeGroup.PrimaryEndpoint != nil && nodeGroup.PrimaryEndpoint.Address != nil {
+			return *nodeGroup.PrimaryEndpoint.Address
+		}
+	}
+	return ""
+}
+
+func (self *SElasticache) GetPrivateIpAddr() string {
+	return ""
+}
+
+func (self *SElasticache) GetPrivateConnectPort() int {
+	for _, nodeGroup := range self.replicaGroup.NodeGroups {
+		if nodeGroup != nil && nodeGroup.PrimaryEndpoint != nil && nodeGroup.PrimaryEndpoint.Port != nil {
+			return int(*nodeGroup.PrimaryEndpoint.Port)
+		}
+	}
+	return 0
+}
+
+func (self *SElasticache) GetPublicDNS() string {
+	return ""
+}
+
+func (self *SElasticache) GetPublicIpAddr() string {
+	return ""
+}
+
+func (self *SElasticache) GetPublicConnectPort() int {
+	return 0
+}
+
+func (self *SElasticache) GetMaintainStartTime() string {
+	self.fetchClusters()
+	window := ""
+	for _, cluster := range self.cacheClusters {
+		if cluster != nil && cluster.PreferredMaintenanceWindow != nil {
+			window = *cluster.PreferredMaintenanceWindow
+			break
+		}
+	}
+
+	splited := strings.Split(window, "-")
+	return splited[0]
+}
+
+func (self *SElasticache) GetMaintainEndTime() string {
+	self.fetchClusters()
+	window := ""
+	for _, cluster := range self.cacheClusters {
+		if cluster != nil && cluster.PreferredMaintenanceWindow != nil {
+			window = *cluster.PreferredMaintenanceWindow
+			break
+		}
+	}
+
+	splited := strings.Split(window, "-")
+	if len(splited) == 2 {
+		return splited[1]
+	}
+	return ""
+}
+
+func (self *SElasticache) GetUsers() ([]SElasticacheUser, error) {
+	result := []SElasticacheUser{}
+	users, err := self.region.DescribeUsers("")
+	if err != nil {
+		return nil, errors.Wrap(err, "self.region.DescribeUsers")
+	}
+	for i := range users {
+		result = append(result, SElasticacheUser{region: self.region, user: users[i]})
+	}
+	return result, nil
+}
+
+func (self *SElasticache) GetICloudElasticcacheAccounts() ([]cloudprovider.ICloudElasticcacheAccount, error) {
+	result := []cloudprovider.ICloudElasticcacheAccount{}
+	users, err := self.GetUsers()
+	if err != nil {
+		return nil, errors.Wrap(err, "self.GetUsers()")
+	}
+	for i := range users {
+		result = append(result, &users[i])
+	}
+	return result, nil
+}
+
+func (self *SElasticache) GetUserById(id string) (*SElasticacheUser, error) {
+	users, err := self.region.DescribeUsers("")
+	if err != nil {
+		return nil, errors.Wrap(err, "self.region.DescribeUsers")
+	}
+	for i := range users {
+		temp := SElasticacheUser{region: self.region, user: users[i]}
+		if temp.GetId() == id {
+			return &temp, nil
+		}
+	}
+	return nil, cloudprovider.ErrNotFound
+}
+
+func (self *SElasticache) GetICloudElasticcacheAccount(accountId string) (cloudprovider.ICloudElasticcacheAccount, error) {
+	user, err := self.GetUserById(accountId)
+	if err != nil {
+		return nil, errors.Wrapf(err, "self.GetUserById(%s)", accountId)
+	}
+	return user, nil
+}
+
+func (self *SElasticache) GetICloudElasticcacheAcls() ([]cloudprovider.ICloudElasticcacheAcl, error) {
+	return []cloudprovider.ICloudElasticcacheAcl{}, nil
+}
+
+func (self *SElasticache) GetICloudElasticcacheAcl(aclId string) (cloudprovider.ICloudElasticcacheAcl, error) {
+	return nil, cloudprovider.ErrNotSupported
+}
+
+func (self *SElasticache) GetSnapshots() ([]SElasticacheSnapshop, error) {
+	result := []SElasticacheSnapshop{}
+	snapshots, err := self.region.DescribeSnapshots(self.GetName(), "")
+	if err != nil {
+		return nil, errors.Wrapf(err, " self.region.DescribeSnapshots(%s)", self.GetName())
+	}
+
+	for i := range snapshots {
+		result = append(result, SElasticacheSnapshop{region: self.region, snapshot: snapshots[i]})
+	}
+	return result, nil
+}
+
+func (self *SElasticache) GetICloudElasticcacheBackups() ([]cloudprovider.ICloudElasticcacheBackup, error) {
+	snapshots, err := self.GetSnapshots()
+	if err != nil {
+		return nil, errors.Wrap(err, "self.GetSnapshots()")
+	}
+	result := []cloudprovider.ICloudElasticcacheBackup{}
+	for i := range snapshots {
+		result = append(result, &snapshots[i])
+	}
+	return result, nil
+}
+
+func (self *SElasticache) GetICloudElasticcacheBackup(backupId string) (cloudprovider.ICloudElasticcacheBackup, error) {
+	snapshots, err := self.GetSnapshots()
+	if err != nil {
+		return nil, errors.Wrap(err, "self.GetSnapshots()")
+	}
+	for i := range snapshots {
+		if snapshots[i].GetId() == backupId {
+			return &snapshots[i], nil
+		}
+	}
+	return nil, cloudprovider.ErrNotFound
+}
+
+func (self *SElasticache) GetParameterGroupName() (string, error) {
+	err := self.fetchClusters()
+	if err != nil {
+		return "", errors.Wrap(err, "self.fetchClusters()")
+	}
+	for _, cluster := range self.cacheClusters {
+		if cluster != nil && cluster.CacheParameterGroup != nil && cluster.CacheParameterGroup.CacheParameterGroupName != nil {
+			return *cluster.CacheParameterGroup.CacheParameterGroupName, nil
+		}
+	}
+
+	return "", cloudprovider.ErrNotFound
+}
+
+func (self *SElasticache) GetParameters() ([]SElasticacheParameter, error) {
+	groupName, err := self.GetParameterGroupName()
+	if err != nil {
+		return nil, errors.Wrap(err, "self.GetParameterGroupName()")
+	}
+	parameters, err := self.region.DescribeCacheParameters(groupName)
+	if err != nil {
+		return nil, errors.Wrapf(err, "self.region.DescribeCacheParameters(%s)", groupName)
+	}
+
+	result := []SElasticacheParameter{}
+
+	for i := range parameters {
+		result = append(result, SElasticacheParameter{parameterGroup: groupName, parameter: parameters[i]})
+	}
+	return result, nil
+}
+
+func (self *SElasticache) GetICloudElasticcacheParameters() ([]cloudprovider.ICloudElasticcacheParameter, error) {
+	parameters, err := self.GetParameters()
+	if err != nil {
+		return nil, errors.Wrap(err, "self.GetParameters()")
+	}
+	result := []cloudprovider.ICloudElasticcacheParameter{}
+	for i := range parameters {
+		result = append(result, &parameters[i])
+	}
+	return result, nil
+}
+
+func (self *SElasticache) GetSecurityGroupIds() ([]string, error) {
+	err := self.fetchClusters()
+	if err != nil {
+		return nil, errors.Wrap(err, "self.fetchClusters()")
+	}
+	result := []string{}
+	for _, cluster := range self.cacheClusters {
+		if cluster != nil {
+			for _, securityGroup := range cluster.SecurityGroups {
+				if securityGroup != nil && securityGroup.Status != nil && *securityGroup.Status == "active" {
+					if securityGroup.SecurityGroupId != nil {
+						result = append(result, *securityGroup.SecurityGroupId)
+					}
+				}
+			}
+		}
+	}
+
+	return result, nil
+}
+
+func (self *SElasticache) AllocatePublicConnection(port int) (string, error) {
+	return "", cloudprovider.ErrNotSupported
+}
+
+func (self *SElasticache) ChangeInstanceSpec(spec string) error {
+	return cloudprovider.ErrNotSupported
+}
+
+func (self *SElasticache) CreateAccount(input cloudprovider.SCloudElasticCacheAccountInput) (cloudprovider.ICloudElasticcacheAccount, error) {
+	return nil, cloudprovider.ErrNotImplemented
+}
+
+func (self *SElasticache) CreateAcl(aclName, securityIps string) (cloudprovider.ICloudElasticcacheAcl, error) {
+	return nil, cloudprovider.ErrNotSupported
+}
+
+func (self *SElasticache) CreateBackup(desc string) (cloudprovider.ICloudElasticcacheBackup, error) {
+	return nil, cloudprovider.ErrNotImplemented
+}
+
+func (self *SElasticache) Delete() error {
+	return cloudprovider.ErrNotImplemented
+}
+
+func (self *SElasticache) FlushInstance(input cloudprovider.SCloudElasticCacheFlushInstanceInput) error {
+	return cloudprovider.ErrNotSupported
+}
+
+func (self *SElasticache) GetAuthMode() string {
+	return ""
+}
+
+func (self *SElasticache) ReleasePublicConnection() error {
+	return cloudprovider.ErrNotSupported
+}
+
+func (self *SElasticache) Renew(bc billing.SBillingCycle) error {
+	return cloudprovider.ErrNotSupported
+}
+
+func (self *SElasticache) Restart() error {
+	return cloudprovider.ErrNotSupported
+}
+
+func (self *SElasticache) SetMaintainTime(maintainStartTime, maintainEndTime string) error {
+	return cloudprovider.ErrNotImplemented
+}
+
+func (self *SElasticache) UpdateAuthMode(noPwdAccess bool, password string) error {
+	return cloudprovider.ErrNotImplemented
+}
+
+func (self *SElasticache) UpdateBackupPolicy(config cloudprovider.SCloudElasticCacheBackupPolicyUpdateInput) error {
+	return cloudprovider.ErrNotImplemented
+}
+
+func (self *SElasticache) UpdateInstanceParameters(config jsonutils.JSONObject) error {
+	return cloudprovider.ErrNotImplemented
+}
+
+func (self *SElasticache) UpdateSecurityGroups(secgroupIds []string) error {
+	return cloudprovider.ErrNotImplemented
+}

pkg/multicloud/aws/elasticache_parameter.go

@@ -0,0 +1,129 @@
+// Copyright 2019 Yunion
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package aws
+
+import (
+	"fmt"
+
+	"github.com/aws/aws-sdk-go/service/elasticache"
+
+	"yunion.io/x/pkg/errors"
+
+	api "yunion.io/x/onecloud/pkg/apis/compute"
+	"yunion.io/x/onecloud/pkg/multicloud"
+)
+
+func (region *SRegion) DescribeCacheParameters(parameterGroupId string) ([]*elasticache.Parameter, error) {
+	ecClient, err := region.getAwsElasticacheClient()
+	if err != nil {
+		return nil, errors.Wrap(err, "client.getAwsElasticacheClient")
+	}
+
+	input := elasticache.DescribeCacheParametersInput{}
+	if len(parameterGroupId) > 0 {
+		input.CacheParameterGroupName = &parameterGroupId
+	}
+
+	marker := ""
+	maxrecords := (int64)(50)
+	input.MaxRecords = &maxrecords
+
+	parameters := []*elasticache.Parameter{}
+	for {
+		if len(marker) >= 0 {
+			input.Marker = &marker
+		}
+		out, err := ecClient.DescribeCacheParameters(&input)
+		if err != nil {
+			return nil, errors.Wrap(err, "ecClient.DescribeCacheParameters")
+		}
+		parameters = append(parameters, out.Parameters...)
+
+		if out.Marker != nil && len(*out.Marker) > 0 {
+			marker = *out.Marker
+		} else {
+			break
+		}
+	}
+
+	return parameters, nil
+}
+
+type SElasticacheParameter struct {
+	multicloud.SElasticcacheParameterBase
+	parameterGroup string
+	parameter      *elasticache.Parameter
+}
+
+func (self *SElasticacheParameter) GetId() string {
+	return fmt.Sprintf("%s/%s", self.parameterGroup, *self.parameter.ParameterName)
+}
+
+func (self *SElasticacheParameter) GetName() string {
+	return *self.parameter.ParameterName
+}
+
+func (self *SElasticacheParameter) GetGlobalId() string {
+	return self.GetId()
+}
+
+func (self *SElasticacheParameter) GetStatus() string {
+	return api.ELASTIC_CACHE_PARAMETER_STATUS_AVAILABLE
+}
+
+func (self *SElasticacheParameter) GetParameterKey() string {
+	if self.parameter == nil || self.parameter.ParameterName == nil {
+		return ""
+	}
+	return *self.parameter.ParameterName
+}
+
+func (self *SElasticacheParameter) GetParameterValue() string {
+	if self.parameter == nil || self.parameter.ParameterValue == nil {
+		return ""
+	}
+	return *self.parameter.ParameterValue
+}
+
+func (self *SElasticacheParameter) GetParameterValueRange() string {
+	if self.parameter == nil || self.parameter.AllowedValues == nil {
+		return ""
+	}
+	return *self.parameter.AllowedValues
+}
+
+func (self *SElasticacheParameter) GetDescription() string {
+	if self.parameter == nil || self.parameter.Description == nil {
+		return ""
+	}
+	return *self.parameter.Description
+}
+
+func (self *SElasticacheParameter) GetModifiable() bool {
+	if self.parameter == nil || self.parameter.IsModifiable == nil {
+		return *self.parameter.IsModifiable
+	}
+	return false
+}
+
+func (self *SElasticacheParameter) GetForceRestart() bool {
+	if self.parameter == nil || self.parameter.ChangeType == nil {
+		return false
+	}
+	if *self.parameter.ChangeType == "requires-reboot" {
+		return true
+	}
+	return false
+}

pkg/multicloud/aws/elasticache_snapshot.go

@@ -0,0 +1,201 @@
+// Copyright 2019 Yunion
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package aws
+
+import (
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/aws/aws-sdk-go/service/elasticache"
+
+	"yunion.io/x/pkg/errors"
+
+	api "yunion.io/x/onecloud/pkg/apis/compute"
+	"yunion.io/x/onecloud/pkg/cloudprovider"
+	"yunion.io/x/onecloud/pkg/multicloud"
+)
+
+func (region *SRegion) DescribeSnapshots(replicaGroupId string, snapshotName string) ([]*elasticache.Snapshot, error) {
+	ecClient, err := region.getAwsElasticacheClient()
+	if err != nil {
+		return nil, errors.Wrap(err, "client.getAwsElasticacheClient")
+	}
+
+	input := elasticache.DescribeSnapshotsInput{}
+	if len(replicaGroupId) > 0 {
+		input.ReplicationGroupId = &replicaGroupId
+	}
+	if len(snapshotName) > 0 {
+		input.SnapshotName = &snapshotName
+	}
+	marker := ""
+	maxrecords := (int64)(50)
+	input.MaxRecords = &maxrecords
+
+	snapshot := []*elasticache.Snapshot{}
+	for {
+		if len(marker) >= 0 {
+			input.Marker = &marker
+		}
+		out, err := ecClient.DescribeSnapshots(&input)
+		if err != nil {
+			return nil, errors.Wrap(err, "ecClient.DescribeCacheClusters")
+		}
+		snapshot = append(snapshot, out.Snapshots...)
+
+		if out.Marker != nil && len(*out.Marker) > 0 {
+			marker = *out.Marker
+		} else {
+			break
+		}
+	}
+
+	return snapshot, nil
+}
+
+type SElasticacheSnapshop struct {
+	multicloud.SElasticcacheBackupBase
+	region *SRegion
+
+	snapshot *elasticache.Snapshot
+}
+
+func (self *SElasticacheSnapshop) GetId() string {
+	return *self.snapshot.SnapshotName
+}
+
+func (self *SElasticacheSnapshop) GetName() string {
+	return *self.snapshot.SnapshotName
+}
+
+func (self *SElasticacheSnapshop) GetGlobalId() string {
+	return self.GetId()
+}
+
+func (self *SElasticacheSnapshop) GetStatus() string {
+	if self.snapshot == nil || self.snapshot.SnapshotStatus == nil {
+		return api.ELASTIC_CACHE_BACKUP_STATUS_UNKNOWN
+	}
+	// creating | available | restoring | copying | deleting
+	switch *self.snapshot.SnapshotStatus {
+	case "creating":
+		return api.ELASTIC_CACHE_BACKUP_STATUS_CREATING
+	case "available":
+		return api.ELASTIC_CACHE_BACKUP_STATUS_SUCCESS
+	case "restoring":
+		return api.ELASTIC_CACHE_BACKUP_STATUS_RESTORING
+	case "copying":
+		return api.ELASTIC_CACHE_BACKUP_STATUS_COPYING
+	case "deleting":
+		return api.ELASTIC_CACHE_BACKUP_STATUS_DELETING
+	default:
+		return ""
+	}
+}
+
+func (self *SElasticacheSnapshop) Refresh() error {
+	snapshots, err := self.region.DescribeSnapshots("", self.GetName())
+	if err != nil {
+		return errors.Wrapf(err, `self.region.DescribeSnapshots("", %s)`, self.GetName())
+	}
+
+	if len(snapshots) == 0 {
+		return cloudprovider.ErrNotFound
+	}
+	if len(snapshots) > 1 {
+		return cloudprovider.ErrDuplicateId
+	}
+
+	self.snapshot = snapshots[0]
+	return nil
+}
+
+func (self *SElasticacheSnapshop) GetBackupSizeMb() int {
+	total := 0
+	if self.snapshot != nil && len(self.snapshot.NodeSnapshots) > 0 {
+		for i := range self.snapshot.NodeSnapshots {
+			if self.snapshot.NodeSnapshots[i] != nil && self.snapshot.NodeSnapshots[0].CacheSize != nil {
+				sizeStr := *self.snapshot.NodeSnapshots[0].CacheSize
+				splited := strings.Split(sizeStr, " ")
+				if len(splited) != 2 {
+					return 0
+				}
+				size, err := strconv.Atoi(splited[0])
+				if err != nil {
+					return 0
+				}
+				switch splited[1] {
+				case "MB":
+					total += size
+				case "GB":
+					total += size * 1024
+				case "TB":
+					total += size * 1024 * 1024
+				}
+			}
+		}
+	}
+
+	return total
+}
+
+func (self *SElasticacheSnapshop) GetBackupType() string {
+	return api.ELASTIC_CACHE_BACKUP_TYPE_FULL
+}
+
+func (self *SElasticacheSnapshop) GetBackupMode() string {
+	if self.snapshot != nil && self.snapshot.SnapshotSource != nil {
+		source := *self.snapshot.SnapshotSource
+		// automated manual
+		switch source {
+		case "automated":
+			return api.ELASTIC_CACHE_BACKUP_MODE_AUTOMATED
+		case "manual":
+			return api.ELASTIC_CACHE_BACKUP_MODE_MANUAL
+		default:
+			return source
+		}
+	}
+	return ""
+}
+
+func (self *SElasticacheSnapshop) GetDownloadURL() string {
+	return ""
+}
+
+func (self *SElasticacheSnapshop) GetStartTime() time.Time {
+	if self.snapshot == nil {
+		return time.Time{}
+	}
+	for _, nodeSnapshot := range self.snapshot.NodeSnapshots {
+		if nodeSnapshot != nil && nodeSnapshot.SnapshotCreateTime != nil {
+			return *nodeSnapshot.SnapshotCreateTime
+		}
+	}
+	return time.Time{}
+}
+
+func (self *SElasticacheSnapshop) GetEndTime() time.Time {
+	return time.Time{}
+}
+
+func (self *SElasticacheSnapshop) Delete() error {
+	return cloudprovider.ErrNotSupported
+}
+
+func (self *SElasticacheSnapshop) RestoreInstance(instanceId string) error {
+	return cloudprovider.ErrNotSupported
+}

pkg/multicloud/aws/elasticache_user.go

@@ -0,0 +1,131 @@
+// Copyright 2019 Yunion
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package aws
+
+import (
+	"github.com/aws/aws-sdk-go/service/elasticache"
+
+	"yunion.io/x/pkg/errors"
+
+	api "yunion.io/x/onecloud/pkg/apis/compute"
+	"yunion.io/x/onecloud/pkg/cloudprovider"
+	"yunion.io/x/onecloud/pkg/multicloud"
+)
+
+func (region *SRegion) DescribeUsers(engine string) ([]*elasticache.User, error) {
+	ecClient, err := region.getAwsElasticacheClient()
+	if err != nil {
+		return nil, errors.Wrap(err, "client.getAwsElasticacheClient")
+	}
+
+	input := elasticache.DescribeUsersInput{}
+	if len(engine) > 0 {
+		input.Engine = &engine
+	}
+	marker := ""
+	maxrecords := (int64)(50)
+	input.MaxRecords = &maxrecords
+
+	users := []*elasticache.User{}
+	for {
+		if len(marker) >= 0 {
+			input.Marker = &marker
+		}
+		out, err := ecClient.DescribeUsers(&input)
+		if err != nil {
+			return nil, errors.Wrap(err, "ecClient.DescribeCacheClusters")
+		}
+		users = append(users, out.Users...)
+
+		if out.Marker != nil && len(*out.Marker) > 0 {
+			marker = *out.Marker
+		} else {
+			break
+		}
+	}
+
+	return users, nil
+}
+
+type SElasticacheUser struct {
+	multicloud.SElasticcacheAccountBase
+	region *SRegion
+	user   *elasticache.User
+}
+
+func (self *SElasticacheUser) GetId() string {
+	return *self.user.UserId
+}
+
+func (self *SElasticacheUser) GetName() string {
+	return *self.user.UserName
+}
+
+func (self *SElasticacheUser) GetGlobalId() string {
+	return self.GetId()
+}
+
+func (self *SElasticacheUser) GetStatus() string {
+	if self.user == nil || self.user.Status == nil {
+		return ""
+	}
+	//  "active", "modifying" or "deleting"
+	switch *self.user.Status {
+	case "active":
+		return api.ELASTIC_CACHE_ACCOUNT_STATUS_AVAILABLE
+	case "modifying":
+		return api.ELASTIC_CACHE_ACCOUNT_STATUS_MODIFYING
+	case "deleting":
+		return api.ELASTIC_CACHE_ACCOUNT_STATUS_DELETING
+	default:
+		return ""
+	}
+}
+
+func (self *SElasticacheUser) Refresh() error {
+	users, err := self.region.DescribeUsers("")
+	if err != nil {
+		return errors.Wrap(err, "region.DescribeUsers")
+	}
+	for i := range users {
+		if users[i] != nil && users[i].UserId != nil && *users[i].UserId == self.GetId() {
+			self.user = users[i]
+		}
+	}
+	return nil
+}
+
+func (self *SElasticacheUser) GetAccountType() string {
+	return ""
+}
+
+func (self *SElasticacheUser) GetAccountPrivilege() string {
+	if self.user != nil && self.user.AccessString != nil {
+		return *self.user.AccessString
+	}
+	return ""
+}
+
+func (self *SElasticacheUser) Delete() error {
+	return cloudprovider.ErrNotSupported
+}
+
+func (self *SElasticacheUser) ResetPassword(input cloudprovider.SCloudElasticCacheAccountResetPasswordInput) error {
+	return cloudprovider.ErrNotSupported
+}
+
+func (self *SElasticacheUser) UpdateAccount(input cloudprovider.SCloudElasticCacheAccountUpdateInput) error {
+	return cloudprovider.ErrNotSupported
+}

pkg/multicloud/aws/region.go

@@ -120,6 +120,8 @@ const (
 	CLOUD_TRAIL_SERVICE_ID   = "cloudtrail"
 
 	ROUTE53_SERVICE_NAME = "route53"
+
+	ELASTICACHE_SERVICE_NAME = "elasticache"
 )
 
 type SRegion struct {

pkg/multicloud/aws/shell/elasticache.go

@@ -0,0 +1,94 @@
+// Copyright 2019 Yunion
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package shell
+
+import (
+	"yunion.io/x/onecloud/pkg/multicloud/aws"
+	"yunion.io/x/onecloud/pkg/util/shellutils"
+)
+
+func init() {
+	type ElasticacheClusterListOption struct {
+	}
+	shellutils.R(&ElasticacheClusterListOption{}, "elasticacheCluster-list", "List elasticacheCluster", func(cli *aws.SRegion, args *ElasticacheClusterListOption) error {
+		clusters, e := cli.DescribeElasticacheClusters()
+		if e != nil {
+			return e
+		}
+		printList(clusters, len(clusters), 0, len(clusters), []string{})
+		return nil
+	})
+
+	type ElasticacheReplicaGroupListOption struct {
+		Id string
+	}
+	shellutils.R(&ElasticacheReplicaGroupListOption{}, "elasticacheReplicaGroup-list", "List elasticaReplicaGroup", func(cli *aws.SRegion, args *ElasticacheReplicaGroupListOption) error {
+		clusters, e := cli.DescribeElasticacheReplicationGroups(args.Id)
+		if e != nil {
+			return e
+		}
+		printList(clusters, len(clusters), 0, len(clusters), []string{})
+		return nil
+	})
+
+	type ElasticacheSubnetGroupOption struct {
+		Id string `help:"subnetgroupId"`
+	}
+	shellutils.R(&ElasticacheSubnetGroupOption{}, "elasticacheSubnetGroup-show", "List elasticacheSubnetGroup", func(cli *aws.SRegion, args *ElasticacheSubnetGroupOption) error {
+		subnetGroups, e := cli.DescribeCacheSubnetGroups(args.Id)
+		if e != nil {
+			return e
+		}
+		printList(subnetGroups, len(subnetGroups), 0, len(subnetGroups), []string{})
+		return nil
+	})
+
+	type ElasticacheSnapshotOption struct {
+		ReplicaGroupId string `help:"replicaGroupId"`
+		SnapshotId     string `help:"SnapshotId"`
+	}
+	shellutils.R(&ElasticacheSnapshotOption{}, "elasticacheSnapshot-list", "List elasticacheSnapshot", func(cli *aws.SRegion, args *ElasticacheSnapshotOption) error {
+		snapshots, e := cli.DescribeSnapshots(args.ReplicaGroupId, args.SnapshotId)
+		if e != nil {
+			return e
+		}
+		printList(snapshots, len(snapshots), 0, len(snapshots), []string{})
+		return nil
+	})
+
+	type ElasticacheParameterOption struct {
+		ParameterGroupId string
+	}
+	shellutils.R(&ElasticacheParameterOption{}, "elasticacheParameter-list", "List elasticacheParameter", func(cli *aws.SRegion, args *ElasticacheParameterOption) error {
+		parameters, e := cli.DescribeCacheParameters(args.ParameterGroupId)
+		if e != nil {
+			return e
+		}
+		printList(parameters, len(parameters), 0, len(parameters), []string{})
+		return nil
+	})
+
+	type ElasticacheUserOption struct {
+		Engine string `help:"redis"`
+	}
+	shellutils.R(&ElasticacheUserOption{}, "elasticacheUser-list", "List elasticacheUser", func(cli *aws.SRegion, args *ElasticacheUserOption) error {
+		users, e := cli.DescribeUsers(args.Engine)
+		if e != nil {
+			return e
+		}
+		printList(users, len(users), 0, len(users), []string{})
+		return nil
+	})
+}

vendor/github.com/aws/aws-sdk-go/aws/config.go

@@ -43,7 +43,7 @@ type Config struct {
 
 	// An optional endpoint URL (hostname only or fully qualified URI)
 	// that overrides the default generated endpoint for a client. Set this
-	// to `""` to use the default generated endpoint.
+	// to `nil` or the value to `""` to use the default generated endpoint.
 	//
 	// Note: You must still provide a `Region` value when specifying an
 	// endpoint for a client.
@@ -138,7 +138,7 @@ type Config struct {
 	// `ExpectContinueTimeout` for information on adjusting the continue wait
 	// timeout. https://golang.org/pkg/net/http/#Transport
 	//
-	// You should use this flag to disble 100-Continue if you experience issues
+	// You should use this flag to disable 100-Continue if you experience issues
 	// with proxies or third party S3 compatible services.
 	S3Disable100Continue *bool
 
@@ -183,7 +183,7 @@ type Config struct {
 	//
 	// Example:
 	//    sess := session.Must(session.NewSession(aws.NewConfig()
-	//       .WithEC2MetadataDiableTimeoutOverride(true)))
+	//       .WithEC2MetadataDisableTimeoutOverride(true)))
 	//
 	//    svc := s3.New(sess)
 	//
@@ -194,7 +194,7 @@ type Config struct {
 	// both IPv4 and IPv6 addressing.
 	//
 	// Setting this for a service which does not support dual stack will fail
-	// to make requets. It is not recommended to set this value on the session
+	// to make requests. It is not recommended to set this value on the session
 	// as it will apply to all service clients created with the session. Even
 	// services which don't support dual stack endpoints.
 	//
@@ -238,6 +238,7 @@ type Config struct {
 
 	// EnableEndpointDiscovery will allow for endpoint discovery on operations that
 	// have the definition in its model. By default, endpoint discovery is off.
+	// To use EndpointDiscovery, Endpoint should be unset or set to an empty string.
 	//
 	// Example:
 	//    sess := session.Must(session.NewSession(&aws.Config{
@@ -437,13 +438,6 @@ func (c *Config) WithDisableEndpointHostPrefix(t bool) *Config {
 	return c
 }
 
-// MergeIn merges the passed in configs into the existing config object.
-func (c *Config) MergeIn(cfgs ...*Config) {
-	for _, other := range cfgs {
-		mergeInConfig(c, other)
-	}
-}
-
 // WithSTSRegionalEndpoint will set whether or not to use regional endpoint flag
 // when resolving the endpoint for a service
 func (c *Config) WithSTSRegionalEndpoint(sre endpoints.STSRegionalEndpoint) *Config {
@@ -458,6 +452,27 @@ func (c *Config) WithS3UsEast1RegionalEndpoint(sre endpoints.S3UsEast1RegionalEn
 	return c
 }
 
+// WithLowerCaseHeaderMaps sets a config LowerCaseHeaderMaps value
+// returning a Config pointer for chaining.
+func (c *Config) WithLowerCaseHeaderMaps(t bool) *Config {
+	c.LowerCaseHeaderMaps = &t
+	return c
+}
+
+// WithDisableRestProtocolURICleaning sets a config DisableRestProtocolURICleaning value
+// returning a Config pointer for chaining.
+func (c *Config) WithDisableRestProtocolURICleaning(t bool) *Config {
+	c.DisableRestProtocolURICleaning = &t
+	return c
+}
+
+// MergeIn merges the passed in configs into the existing config object.
+func (c *Config) MergeIn(cfgs ...*Config) {
+	for _, other := range cfgs {
+		mergeInConfig(c, other)
+	}
+}
+
 func mergeInConfig(dst *Config, other *Config) {
 	if other == nil {
 		return
@@ -570,6 +585,10 @@ func mergeInConfig(dst *Config, other *Config) {
 	if other.S3UsEast1RegionalEndpoint != endpoints.UnsetS3UsEast1Endpoint {
 		dst.S3UsEast1RegionalEndpoint = other.S3UsEast1RegionalEndpoint
 	}
+
+	if other.LowerCaseHeaderMaps != nil {
+		dst.LowerCaseHeaderMaps = other.LowerCaseHeaderMaps
+	}
 }
 
 // Copy will return a shallow copy of the Config object. If any additional

vendor/github.com/aws/aws-sdk-go/aws/corehandlers/handlers.go

@@ -225,6 +225,8 @@ var ValidateEndpointHandler = request.NamedHandler{Name: "core.ValidateEndpointH
 	if r.ClientInfo.SigningRegion == "" && aws.StringValue(r.Config.Region) == "" {
 		r.Error = aws.ErrMissingRegion
 	} else if r.ClientInfo.Endpoint == "" {
+		// Was any endpoint provided by the user, or one was derived by the
+		// SDK's endpoint resolver?
 		r.Error = aws.ErrMissingEndpoint
 	}
 }}

vendor/github.com/aws/aws-sdk-go/aws/credentials/credentials.go

@@ -50,7 +50,7 @@ package credentials
 
 import (
 	"fmt"
-	"sync/atomic"
+	"sync"
 	"time"
 
 	"github.com/aws/aws-sdk-go/aws/awserr"
@@ -173,7 +173,9 @@ type Expiry struct {
 // the expiration time given to ensure no requests are made with expired
 // tokens.
 func (e *Expiry) SetExpiration(expiration time.Time, window time.Duration) {
-	e.expiration = expiration
+	// Passed in expirations should have the monotonic clock values stripped.
+	// This ensures time comparisons will be based on wall-time.
+	e.expiration = expiration.Round(0)
 	if window > 0 {
 		e.expiration = e.expiration.Add(-window)
 	}
@@ -205,9 +207,10 @@ func (e *Expiry) ExpiresAt() time.Time {
 // first instance of the credentials Value. All calls to Get() after that
 // will return the cached credentials Value until IsExpired() returns true.
 type Credentials struct {
-	creds atomic.Value
-	sf    singleflight.Group
+	sf singleflight.Group
 
+	m        sync.RWMutex
+	creds    Value
 	provider Provider
 }
 
@@ -216,7 +219,6 @@ func NewCredentials(provider Provider) *Credentials {
 	c := &Credentials{
 		provider: provider,
 	}
-	c.creds.Store(Value{})
 	return c
 }
 
@@ -233,8 +235,17 @@ func NewCredentials(provider Provider) *Credentials {
 //
 // Passed in Context is equivalent to aws.Context, and context.Context.
 func (c *Credentials) GetWithContext(ctx Context) (Value, error) {
-	if curCreds := c.creds.Load(); !c.isExpired(curCreds) {
-		return curCreds.(Value), nil
+	// Check if credentials are cached, and not expired.
+	select {
+	case curCreds, ok := <-c.asyncIsExpired():
+		// ok will only be true, of the credentials were not expired. ok will
+		// be false and have no value if the credentials are expired.
+		if ok {
+			return curCreds, nil
+		}
+	case <-ctx.Done():
+		return Value{}, awserr.New("RequestCanceled",
+			"request context canceled", ctx.Err())
 	}
 
 	// Cannot pass context down to the actual retrieve, because the first
@@ -252,18 +263,23 @@ func (c *Credentials) GetWithContext(ctx Context) (Value, error) {
 	}
 }
 
-func (c *Credentials) singleRetrieve(ctx Context) (creds interface{}, err error) {
-	if curCreds := c.creds.Load(); !c.isExpired(curCreds) {
-		return curCreds.(Value), nil
+func (c *Credentials) singleRetrieve(ctx Context) (interface{}, error) {
+	c.m.Lock()
+	defer c.m.Unlock()
+
+	if curCreds := c.creds; !c.isExpiredLocked(curCreds) {
+		return curCreds, nil
 	}
 
+	var creds Value
+	var err error
 	if p, ok := c.provider.(ProviderWithContext); ok {
 		creds, err = p.RetrieveWithContext(ctx)
 	} else {
 		creds, err = c.provider.Retrieve()
 	}
 	if err == nil {
-		c.creds.Store(creds)
+		c.creds = creds
 	}
 
 	return creds, err
@@ -288,7 +304,10 @@ func (c *Credentials) Get() (Value, error) {
 // This will override the Provider's expired state, and force Credentials
 // to call the Provider's Retrieve().
 func (c *Credentials) Expire() {
-	c.creds.Store(Value{})
+	c.m.Lock()
+	defer c.m.Unlock()
+
+	c.creds = Value{}
 }
 
 // IsExpired returns if the credentials are no longer valid, and need
@@ -297,11 +316,32 @@ func (c *Credentials) Expire() {
 // If the Credentials were forced to be expired with Expire() this will
 // reflect that override.
 func (c *Credentials) IsExpired() bool {
-	return c.isExpired(c.creds.Load())
+	c.m.RLock()
+	defer c.m.RUnlock()
+
+	return c.isExpiredLocked(c.creds)
 }
 
-// isExpired helper method wrapping the definition of expired credentials.
-func (c *Credentials) isExpired(creds interface{}) bool {
+// asyncIsExpired returns a channel of credentials Value. If the channel is
+// closed the credentials are expired and credentials value are not empty.
+func (c *Credentials) asyncIsExpired() <-chan Value {
+	ch := make(chan Value, 1)
+	go func() {
+		c.m.RLock()
+		defer c.m.RUnlock()
+
+		if curCreds := c.creds; !c.isExpiredLocked(curCreds) {
+			ch <- curCreds
+		}
+
+		close(ch)
+	}()
+
+	return ch
+}
+
+// isExpiredLocked helper method wrapping the definition of expired credentials.
+func (c *Credentials) isExpiredLocked(creds interface{}) bool {
 	return creds == nil || creds.(Value) == Value{} || c.provider.IsExpired()
 }
 
@@ -309,13 +349,17 @@ func (c *Credentials) isExpired(creds interface{}) bool {
 // the underlying Provider, if it supports that interface.  Otherwise, it returns
 // an error.
 func (c *Credentials) ExpiresAt() (time.Time, error) {
+	c.m.RLock()
+	defer c.m.RUnlock()
+
 	expirer, ok := c.provider.(Expirer)
 	if !ok {
 		return time.Time{}, awserr.New("ProviderNotExpirer",
-			fmt.Sprintf("provider %s does not support ExpiresAt()", c.creds.Load().(Value).ProviderName),
+			fmt.Sprintf("provider %s does not support ExpiresAt()",
+				c.creds.ProviderName),
 			nil)
 	}
-	if c.creds.Load().(Value) == (Value{}) {
+	if c.creds == (Value{}) {
 		// set expiration time to the distant past
 		return time.Time{}, nil
 	}

vendor/github.com/aws/aws-sdk-go/aws/credentials/shared_credentials_provider.go

@@ -17,8 +17,9 @@ var (
 	ErrSharedCredentialsHomeNotFound = awserr.New("UserHomeNotFound", "user home directory not found.", nil)
 )
 
-// A SharedCredentialsProvider retrieves credentials from the current user's home
-// directory, and keeps track if those credentials are expired.
+// A SharedCredentialsProvider retrieves access key pair (access key ID,
+// secret access key, and session token if present) credentials from the current
+// user's home directory, and keeps track if those credentials are expired.
 //
 // Profile ini file example: $HOME/.aws/credentials
 type SharedCredentialsProvider struct {

vendor/github.com/aws/aws-sdk-go/aws/credentials/stscreds/assume_role_provider.go

@@ -244,9 +244,11 @@ type AssumeRoleProvider struct {
 	MaxJitterFrac float64
 }
 
-// NewCredentials returns a pointer to a new Credentials object wrapping the
+// NewCredentials returns a pointer to a new Credentials value wrapping the
 // AssumeRoleProvider. The credentials will expire every 15 minutes and the
-// role will be named after a nanosecond timestamp of this operation.
+// role will be named after a nanosecond timestamp of this operation. The
+// Credentials value will attempt to refresh the credentials using the provider
+// when Credentials.Get is called, if the cached credentials are expiring.
 //
 // Takes a Config provider to create the STS client. The ConfigProvider is
 // satisfied by the session.Session type.
@@ -268,9 +270,11 @@ func NewCredentials(c client.ConfigProvider, roleARN string, options ...func(*As
 	return credentials.NewCredentials(p)
 }
 
-// NewCredentialsWithClient returns a pointer to a new Credentials object wrapping the
+// NewCredentialsWithClient returns a pointer to a new Credentials value wrapping the
 // AssumeRoleProvider. The credentials will expire every 15 minutes and the
-// role will be named after a nanosecond timestamp of this operation.
+// role will be named after a nanosecond timestamp of this operation. The
+// Credentials value will attempt to refresh the credentials using the provider
+// when Credentials.Get is called, if the cached credentials are expiring.
 //
 // Takes an AssumeRoler which can be satisfied by the STS client.
 //

vendor/github.com/aws/aws-sdk-go/aws/credentials/stscreds/web_identity_provider.go

@@ -52,9 +52,21 @@ type WebIdentityRoleProvider struct {
 	credentials.Expiry
 	PolicyArns []*sts.PolicyDescriptorType
 
-	client       stsiface.STSAPI
+	// Duration the STS credentials will be valid for. Truncated to seconds.
+	// If unset, the assumed role will use AssumeRoleWithWebIdentity's default
+	// expiry duration. See
+	// https://docs.aws.amazon.com/sdk-for-go/api/service/sts/#STS.AssumeRoleWithWebIdentity
+	// for more information.
+	Duration time.Duration
+
+	// The amount of time the credentials will be refreshed before they expire.
+	// This is useful refresh credentials before they expire to reduce risk of
+	// using credentials as they expire. If unset, will default to no expiry
+	// window.
 	ExpiryWindow time.Duration
 
+	client stsiface.STSAPI
+
 	tokenFetcher    TokenFetcher
 	roleARN         string
 	roleSessionName string
@@ -107,11 +119,18 @@ func (p *WebIdentityRoleProvider) RetrieveWithContext(ctx credentials.Context) (
 		// uses unix time in nanoseconds to uniquely identify sessions.
 		sessionName = strconv.FormatInt(now().UnixNano(), 10)
 	}
+
+	var duration *int64
+	if p.Duration != 0 {
+		duration = aws.Int64(int64(p.Duration / time.Second))
+	}
+
 	req, resp := p.client.AssumeRoleWithWebIdentityRequest(&sts.AssumeRoleWithWebIdentityInput{
 		PolicyArns:       p.PolicyArns,
 		RoleArn:          &p.roleARN,
 		RoleSessionName:  &sessionName,
 		WebIdentityToken: aws.String(string(b)),
+		DurationSeconds:  duration,
 	})
 
 	req.SetContext(ctx)

vendor/github.com/aws/aws-sdk-go/aws/ec2metadata/api.go

@@ -20,7 +20,7 @@ func (c *EC2Metadata) getToken(ctx aws.Context, duration time.Duration) (tokenOu
 	op := &request.Operation{
 		Name:       "GetToken",
 		HTTPMethod: "PUT",
-		HTTPPath:   "/api/token",
+		HTTPPath:   "/latest/api/token",
 	}
 
 	var output tokenOutput
@@ -62,7 +62,7 @@ func (c *EC2Metadata) GetMetadataWithContext(ctx aws.Context, p string) (string,
 	op := &request.Operation{
 		Name:       "GetMetadata",
 		HTTPMethod: "GET",
-		HTTPPath:   sdkuri.PathJoin("/meta-data", p),
+		HTTPPath:   sdkuri.PathJoin("/latest/meta-data", p),
 	}
 	output := &metadataOutput{}
 
@@ -88,7 +88,7 @@ func (c *EC2Metadata) GetUserDataWithContext(ctx aws.Context) (string, error) {
 	op := &request.Operation{
 		Name:       "GetUserData",
 		HTTPMethod: "GET",
-		HTTPPath:   "/user-data",
+		HTTPPath:   "/latest/user-data",
 	}
 
 	output := &metadataOutput{}
@@ -113,7 +113,7 @@ func (c *EC2Metadata) GetDynamicDataWithContext(ctx aws.Context, p string) (stri
 	op := &request.Operation{
 		Name:       "GetDynamicData",
 		HTTPMethod: "GET",
-		HTTPPath:   sdkuri.PathJoin("/dynamic", p),
+		HTTPPath:   sdkuri.PathJoin("/latest/dynamic", p),
 	}
 
 	output := &metadataOutput{}

vendor/github.com/aws/aws-sdk-go/aws/ec2metadata/service.go

@@ -5,6 +5,10 @@
 // variable "AWS_EC2_METADATA_DISABLED=true". This environment variable set to
 // true instructs the SDK to disable the EC2 Metadata client. The client cannot
 // be used while the environment variable is set to true, (case insensitive).
+//
+// The endpoint of the EC2 IMDS client can be configured via the environment
+// variable, AWS_EC2_METADATA_SERVICE_ENDPOINT when creating the client with a
+// Session. See aws/session#Options.EC2IMDSEndpoint for more details.
 package ec2metadata
 
 import (
@@ -12,6 +16,7 @@ import (
 	"errors"
 	"io"
 	"net/http"
+	"net/url"
 	"os"
 	"strconv"
 	"strings"
@@ -41,7 +46,7 @@ const (
 	enableTokenProviderHandlerName = "enableTokenProviderHandler"
 
 	// TTL constants
-	defaultTTL = 21600 * time.Second
+	defaultTTL          = 21600 * time.Second
 	ttlExpirationWindow = 30 * time.Second
 )
 
@@ -69,6 +74,9 @@ func New(p client.ConfigProvider, cfgs ...*aws.Config) *EC2Metadata {
 // a client when not using a session. Generally using just New with a session
 // is preferred.
 //
+// Will remove the URL path from the endpoint provided to ensure the EC2 IMDS
+// client is able to communicate with the EC2 IMDS API.
+//
 // If an unmodified HTTP client is provided from the stdlib default, or no client
 // the EC2RoleProvider's EC2Metadata HTTP client's timeout will be shortened.
 // To disable this set Config.EC2MetadataDisableTimeoutOverride to false. Enabled by default.
@@ -86,6 +94,15 @@ func NewClient(cfg aws.Config, handlers request.Handlers, endpoint, signingRegio
 		cfg.MaxRetries = aws.Int(2)
 	}
 
+	if u, err := url.Parse(endpoint); err == nil {
+		// Remove path from the endpoint since it will be added by requests.
+		// This is an artifact of the SDK adding `/latest` to the endpoint for
+		// EC2 IMDS, but this is now moved to the operation definition.
+		u.Path = ""
+		u.RawPath = ""
+		endpoint = u.String()
+	}
+
 	svc := &EC2Metadata{
 		Client: client.New(
 			cfg,

vendor/github.com/aws/aws-sdk-go/aws/ec2metadata/token_provider.go

@@ -87,6 +87,7 @@ func (t *tokenProvider) enableTokenProviderHandler(r *request.Request) {
 	// If the error code status is 401, we enable the token provider
 	if e, ok := r.Error.(awserr.RequestFailure); ok && e != nil &&
 		e.StatusCode() == http.StatusUnauthorized {
+		t.token.Store(ec2Token{})
 		atomic.StoreUint32(&t.disabled, 0)
 	}
 }

vendor/github.com/aws/aws-sdk-go/aws/endpoints/decode.go

@@ -93,7 +93,7 @@ func decodeV3Endpoints(modelDef modelDefinition, opts DecodeModelOptions) (Resol
 }
 
 func custAddS3DualStack(p *partition) {
-	if p.ID != "aws" {
+	if !(p.ID == "aws" || p.ID == "aws-cn" || p.ID == "aws-us-gov") {
 		return
 	}
 

vendor/github.com/aws/aws-sdk-go/aws/endpoints/v3model.go

@@ -7,6 +7,8 @@ import (
 	"strings"
 )
 
+var regionValidationRegex = regexp.MustCompile(`^[[:alnum:]]([[:alnum:]\-]*[[:alnum:]])?$`)
+
 type partitions []partition
 
 func (ps partitions) EndpointFor(service, region string, opts ...func(*Options)) (ResolvedEndpoint, error) {
@@ -124,7 +126,7 @@ func (p partition) EndpointFor(service, region string, opts ...func(*Options)) (
 
 	defs := []endpoint{p.Defaults, s.Defaults}
 
-	return e.resolve(service, p.ID, region, p.DNSSuffix, defs, opt), nil
+	return e.resolve(service, p.ID, region, p.DNSSuffix, defs, opt)
 }
 
 func serviceList(ss services) []string {
@@ -233,7 +235,7 @@ func getByPriority(s []string, p []string, def string) string {
 	return s[0]
 }
 
-func (e endpoint) resolve(service, partitionID, region, dnsSuffix string, defs []endpoint, opts Options) ResolvedEndpoint {
+func (e endpoint) resolve(service, partitionID, region, dnsSuffix string, defs []endpoint, opts Options) (ResolvedEndpoint, error) {
 	var merged endpoint
 	for _, def := range defs {
 		merged.mergeIn(def)
@@ -260,6 +262,10 @@ func (e endpoint) resolve(service, partitionID, region, dnsSuffix string, defs [
 		region = signingRegion
 	}
 
+	if !validateInputRegion(region) {
+		return ResolvedEndpoint{}, fmt.Errorf("invalid region identifier format provided")
+	}
+
 	u := strings.Replace(hostname, "{service}", service, 1)
 	u = strings.Replace(u, "{region}", region, 1)
 	u = strings.Replace(u, "{dnsSuffix}", dnsSuffix, 1)
@@ -274,7 +280,7 @@ func (e endpoint) resolve(service, partitionID, region, dnsSuffix string, defs [
 		SigningName:        signingName,
 		SigningNameDerived: signingNameDerived,
 		SigningMethod:      getByPriority(e.SignatureVersions, signerPriority, defaultSigner),
-	}
+	}, nil
 }
 
 func getEndpointScheme(protocols []string, disableSSL bool) string {
@@ -339,3 +345,7 @@ const (
 	boxedFalse
 	boxedTrue
 )
+
+func validateInputRegion(region string) bool {
+	return regionValidationRegex.MatchString(region)
+}

vendor/github.com/aws/aws-sdk-go/aws/request/connection_reset_error.go

@@ -9,7 +9,8 @@ func isErrConnectionReset(err error) bool {
 		return false
 	}
 
-	if strings.Contains(err.Error(), "connection reset") ||
+	if strings.Contains(err.Error(), "use of closed network connection") ||
+		strings.Contains(err.Error(), "connection reset") ||
 		strings.Contains(err.Error(), "broken pipe") {
 		return true
 	}

vendor/github.com/aws/aws-sdk-go/aws/session/custom_transport.go

@@ -0,0 +1,27 @@
+// +build go1.13
+
+package session
+
+import (
+	"net"
+	"net/http"
+	"time"
+)
+
+// Transport that should be used when a custom CA bundle is specified with the
+// SDK.
+func getCustomTransport() *http.Transport {
+	return &http.Transport{
+		Proxy: http.ProxyFromEnvironment,
+		DialContext: (&net.Dialer{
+			Timeout:   30 * time.Second,
+			KeepAlive: 30 * time.Second,
+			DualStack: true,
+		}).DialContext,
+		ForceAttemptHTTP2:     true,
+		MaxIdleConns:          100,
+		IdleConnTimeout:       90 * time.Second,
+		TLSHandshakeTimeout:   10 * time.Second,
+		ExpectContinueTimeout: 1 * time.Second,
+	}
+}

vendor/github.com/aws/aws-sdk-go/aws/session/custom_transport_go1.12.go

@@ -1,4 +1,4 @@
-// +build go1.7
+// +build !go1.13,go1.7
 
 package session
 
@@ -10,7 +10,7 @@ import (
 
 // Transport that should be used when a custom CA bundle is specified with the
 // SDK.
-func getCABundleTransport() *http.Transport {
+func getCustomTransport() *http.Transport {
 	return &http.Transport{
 		Proxy: http.ProxyFromEnvironment,
 		DialContext: (&net.Dialer{

vendor/github.com/aws/aws-sdk-go/aws/session/custom_transport_go1.5.go

@@ -10,7 +10,7 @@ import (
 
 // Transport that should be used when a custom CA bundle is specified with the
 // SDK.
-func getCABundleTransport() *http.Transport {
+func getCustomTransport() *http.Transport {
 	return &http.Transport{
 		Proxy: http.ProxyFromEnvironment,
 		Dial: (&net.Dialer{

vendor/github.com/aws/aws-sdk-go/aws/session/custom_transport_go1.6.go

@@ -10,7 +10,7 @@ import (
 
 // Transport that should be used when a custom CA bundle is specified with the
 // SDK.
-func getCABundleTransport() *http.Transport {
+func getCustomTransport() *http.Transport {
 	return &http.Transport{
 		Proxy: http.ProxyFromEnvironment,
 		Dial: (&net.Dialer{

vendor/github.com/aws/aws-sdk-go/aws/session/doc.go

@@ -208,6 +208,8 @@ env values as well.
 
 	AWS_SDK_LOAD_CONFIG=1
 
+Custom Shared Config and Credential Files
+
 Shared credentials file path can be set to instruct the SDK to use an alternative
 file for the shared credentials. If not set the file will be loaded from
 $HOME/.aws/credentials on Linux/Unix based systems, and
@@ -222,6 +224,8 @@ $HOME/.aws/config on Linux/Unix based systems, and
 
 	AWS_CONFIG_FILE=$HOME/my_shared_config
 
+Custom CA Bundle
+
 Path to a custom Credentials Authority (CA) bundle PEM file that the SDK
 will use instead of the default system's root CA bundle. Use this only
 if you want to replace the CA bundle the SDK uses for TLS requests.
@@ -241,5 +245,45 @@ over the AWS_CA_BUNDLE environment variable, and will be used if both are set.
 Setting a custom HTTPClient in the aws.Config options will override this setting.
 To use this option and custom HTTP client, the HTTP client needs to be provided
 when creating the session. Not the service client.
+
+Custom Client TLS Certificate
+
+The SDK supports the environment and session option being configured with
+Client TLS certificates that are sent as a part of the client's TLS handshake
+for client authentication. If used, both Cert and Key values are required. If
+one is missing, or either fail to load the contents of the file an error will
+be returned.
+
+HTTP Client's Transport concrete implementation must be a http.Transport
+or creating the session will fail.
+
+	AWS_SDK_GO_CLIENT_TLS_KEY=$HOME/my_client_key
+	AWS_SDK_GO_CLIENT_TLS_CERT=$HOME/my_client_cert
+
+This can also be configured via the session.Options ClientTLSCert and ClientTLSKey.
+
+	sess, err := session.NewSessionWithOptions(session.Options{
+		ClientTLSCert: myCertFile,
+		ClientTLSKey: myKeyFile,
+	})
+
+Custom EC2 IMDS Endpoint
+
+The endpoint of the EC2 IMDS client can be configured via the environment
+variable, AWS_EC2_METADATA_SERVICE_ENDPOINT when creating the client with a
+Session. See Options.EC2IMDSEndpoint for more details.
+
+  AWS_EC2_METADATA_SERVICE_ENDPOINT=http://169.254.169.254
+
+If using an URL with an IPv6 address literal, the IPv6 address
+component must be enclosed in square brackets.
+
+  AWS_EC2_METADATA_SERVICE_ENDPOINT=http://[::1]
+
+The custom EC2 IMDS endpoint can also be specified via the Session options.
+
+  sess, err := session.NewSessionWithOptions(session.Options{
+      EC2IMDSEndpoint: "http://[::1]",
+  })
 */
 package session

vendor/github.com/aws/aws-sdk-go/aws/session/env_config.go

@@ -101,6 +101,18 @@ type envConfig struct {
 	//  AWS_CA_BUNDLE=$HOME/my_custom_ca_bundle
 	CustomCABundle string
 
+	// Sets the TLC client certificate that should be used by the SDK's HTTP transport
+	// when making requests. The certificate must be paired with a TLS client key file.
+	//
+	//  AWS_SDK_GO_CLIENT_TLS_CERT=$HOME/my_client_cert
+	ClientTLSCert string
+
+	// Sets the TLC client key that should be used by the SDK's HTTP transport
+	// when making requests. The key must be paired with a TLS client certificate file.
+	//
+	//  AWS_SDK_GO_CLIENT_TLS_KEY=$HOME/my_client_key
+	ClientTLSKey string
+
 	csmEnabled  string
 	CSMEnabled  *bool
 	CSMPort     string
@@ -148,6 +160,11 @@ type envConfig struct {
 	//
 	// AWS_S3_USE_ARN_REGION=true
 	S3UseARNRegion bool
+
+	// Specifies the alternative endpoint to use for EC2 IMDS.
+	//
+	// AWS_EC2_METADATA_SERVICE_ENDPOINT=http://[::1]
+	EC2IMDSEndpoint string
 }
 
 var (
@@ -211,6 +228,18 @@ var (
 	s3UseARNRegionEnvKey = []string{
 		"AWS_S3_USE_ARN_REGION",
 	}
+	ec2IMDSEndpointEnvKey = []string{
+		"AWS_EC2_METADATA_SERVICE_ENDPOINT",
+	}
+	useCABundleKey = []string{
+		"AWS_CA_BUNDLE",
+	}
+	useClientTLSCert = []string{
+		"AWS_SDK_GO_CLIENT_TLS_CERT",
+	}
+	useClientTLSKey = []string{
+		"AWS_SDK_GO_CLIENT_TLS_KEY",
+	}
 )
 
 // loadEnvConfig retrieves the SDK's environment configuration.
@@ -294,7 +323,9 @@ func envConfigLoad(enableSharedConfig bool) (envConfig, error) {
 		cfg.SharedConfigFile = defaults.SharedConfigFilename()
 	}
 
-	cfg.CustomCABundle = os.Getenv("AWS_CA_BUNDLE")
+	setFromEnvVal(&cfg.CustomCABundle, useCABundleKey)
+	setFromEnvVal(&cfg.ClientTLSCert, useClientTLSCert)
+	setFromEnvVal(&cfg.ClientTLSKey, useClientTLSKey)
 
 	var err error
 	// STS Regional Endpoint variable
@@ -332,6 +363,8 @@ func envConfigLoad(enableSharedConfig bool) (envConfig, error) {
 		}
 	}
 
+	setFromEnvVal(&cfg.EC2IMDSEndpoint, ec2IMDSEndpointEnvKey)
+
 	return cfg, nil
 }
 

vendor/github.com/aws/aws-sdk-go/aws/session/session.go

@@ -25,6 +25,13 @@ const (
 	// ErrCodeSharedConfig represents an error that occurs in the shared
 	// configuration logic
 	ErrCodeSharedConfig = "SharedConfigErr"
+
+	// ErrCodeLoadCustomCABundle error code for unable to load custom CA bundle.
+	ErrCodeLoadCustomCABundle = "LoadCustomCABundleError"
+
+	// ErrCodeLoadClientTLSCert error code for unable to load client TLS
+	// certificate or key
+	ErrCodeLoadClientTLSCert = "LoadClientTLSCertError"
 )
 
 // ErrSharedConfigSourceCollision will be returned if a section contains both
@@ -48,6 +55,8 @@ var ErrSharedConfigInvalidCredSource = awserr.New(ErrCodeSharedConfig, "credenti
 type Session struct {
 	Config   *aws.Config
 	Handlers request.Handlers
+
+	options Options
 }
 
 // New creates a new instance of the handlers merging in the provided configs
@@ -99,7 +108,7 @@ func New(cfgs ...*aws.Config) *Session {
 		return s
 	}
 
-	s := deprecatedNewSession(cfgs...)
+	s := deprecatedNewSession(envCfg, cfgs...)
 	if envErr != nil {
 		msg := "failed to load env config"
 		s.logDeprecatedNewSessionError(msg, envErr, cfgs)
@@ -227,22 +236,68 @@ type Options struct {
 	// the SDK will use instead of the default system's root CA bundle. Use this
 	// only if you want to replace the CA bundle the SDK uses for TLS requests.
 	//
-	// Enabling this option will attempt to merge the Transport into the SDK's HTTP
-	// client. If the client's Transport is not a http.Transport an error will be
-	// returned. If the Transport's TLS config is set this option will cause the SDK
+	// HTTP Client's Transport concrete implementation must be a http.Transport
+	// or creating the session will fail.
+	//
+	// If the Transport's TLS config is set this option will cause the SDK
 	// to overwrite the Transport's TLS config's  RootCAs value. If the CA
 	// bundle reader contains multiple certificates all of them will be loaded.
 	//
-	// The Session option CustomCABundle is also available when creating sessions
-	// to also enable this feature. CustomCABundle session option field has priority
-	// over the AWS_CA_BUNDLE environment variable, and will be used if both are set.
+	// Can also be specified via the environment variable:
+	//
+	//  AWS_CA_BUNDLE=$HOME/ca_bundle
+	//
+	// Can also be specified via the shared config field:
+	//
+	//  ca_bundle = $HOME/ca_bundle
 	CustomCABundle io.Reader
 
+	// Reader for the TLC client certificate that should be used by the SDK's
+	// HTTP transport when making requests. The certificate must be paired with
+	// a TLS client key file. Will be ignored if both are not provided.
+	//
+	// HTTP Client's Transport concrete implementation must be a http.Transport
+	// or creating the session will fail.
+	//
+	// Can also be specified via the environment variable:
+	//
+	//  AWS_SDK_GO_CLIENT_TLS_CERT=$HOME/my_client_cert
+	ClientTLSCert io.Reader
+
+	// Reader for the TLC client key that should be used by the SDK's HTTP
+	// transport when making requests. The key must be paired with a TLS client
+	// certificate file. Will be ignored if both are not provided.
+	//
+	// HTTP Client's Transport concrete implementation must be a http.Transport
+	// or creating the session will fail.
+	//
+	// Can also be specified via the environment variable:
+	//
+	//  AWS_SDK_GO_CLIENT_TLS_KEY=$HOME/my_client_key
+	ClientTLSKey io.Reader
+
 	// The handlers that the session and all API clients will be created with.
 	// This must be a complete set of handlers. Use the defaults.Handlers()
 	// function to initialize this value before changing the handlers to be
 	// used by the SDK.
 	Handlers request.Handlers
+
+	// Allows specifying a custom endpoint to be used by the EC2 IMDS client
+	// when making requests to the EC2 IMDS API. The must endpoint value must
+	// include protocol prefix.
+	//
+	// If unset, will the EC2 IMDS client will use its default endpoint.
+	//
+	// Can also be specified via the environment variable,
+	// AWS_EC2_METADATA_SERVICE_ENDPOINT.
+	//
+	//   AWS_EC2_METADATA_SERVICE_ENDPOINT=http://169.254.169.254
+	//
+	// If using an URL with an IPv6 address literal, the IPv6 address
+	// component must be enclosed in square brackets.
+	//
+	//   AWS_EC2_METADATA_SERVICE_ENDPOINT=http://[::1]
+	EC2IMDSEndpoint string
 }
 
 // NewSessionWithOptions returns a new Session created from SDK defaults, config files,
@@ -300,17 +355,6 @@ func NewSessionWithOptions(opts Options) (*Session, error) {
 		envCfg.EnableSharedConfig = true
 	}
 
-	// Only use AWS_CA_BUNDLE if session option is not provided.
-	if len(envCfg.CustomCABundle) != 0 && opts.CustomCABundle == nil {
-		f, err := os.Open(envCfg.CustomCABundle)
-		if err != nil {
-			return nil, awserr.New("LoadCustomCABundleError",
-				"failed to open custom CA bundle PEM file", err)
-		}
-		defer f.Close()
-		opts.CustomCABundle = f
-	}
-
 	return newSession(opts, envCfg, &opts.Config)
 }
 
@@ -329,7 +373,25 @@ func Must(sess *Session, err error) *Session {
 	return sess
 }
 
-func deprecatedNewSession(cfgs ...*aws.Config) *Session {
+// Wraps the endpoint resolver with a resolver that will return a custom
+// endpoint for EC2 IMDS.
+func wrapEC2IMDSEndpoint(resolver endpoints.Resolver, endpoint string) endpoints.Resolver {
+	return endpoints.ResolverFunc(
+		func(service, region string, opts ...func(*endpoints.Options)) (
+			endpoints.ResolvedEndpoint, error,
+		) {
+			if service == ec2MetadataServiceID {
+				return endpoints.ResolvedEndpoint{
+					URL:           endpoint,
+					SigningName:   ec2MetadataServiceID,
+					SigningRegion: region,
+				}, nil
+			}
+			return resolver.EndpointFor(service, region)
+		})
+}
+
+func deprecatedNewSession(envCfg envConfig, cfgs ...*aws.Config) *Session {
 	cfg := defaults.Config()
 	handlers := defaults.Handlers()
 
@@ -341,6 +403,11 @@ func deprecatedNewSession(cfgs ...*aws.Config) *Session {
 		// endpoints for service client configurations.
 		cfg.EndpointResolver = endpoints.DefaultResolver()
 	}
+
+	if len(envCfg.EC2IMDSEndpoint) != 0 {
+		cfg.EndpointResolver = wrapEC2IMDSEndpoint(cfg.EndpointResolver, envCfg.EC2IMDSEndpoint)
+	}
+
 	cfg.Credentials = defaults.CredChain(cfg, handlers)
 
 	// Reapply any passed in configs to override credentials if set
@@ -349,6 +416,9 @@ func deprecatedNewSession(cfgs ...*aws.Config) *Session {
 	s := &Session{
 		Config:   cfg,
 		Handlers: handlers,
+		options: Options{
+			EC2IMDSEndpoint: envCfg.EC2IMDSEndpoint,
+		},
 	}
 
 	initHandlers(s)
@@ -415,9 +485,14 @@ func newSession(opts Options, envCfg envConfig, cfgs ...*aws.Config) (*Session,
 		return nil, err
 	}
 
+	if err := setTLSOptions(&opts, cfg, envCfg, sharedCfg); err != nil {
+		return nil, err
+	}
+
 	s := &Session{
 		Config:   cfg,
 		Handlers: handlers,
+		options:  opts,
 	}
 
 	initHandlers(s)
@@ -433,13 +508,6 @@ func newSession(opts Options, envCfg envConfig, cfgs ...*aws.Config) (*Session,
 		}
 	}
 
-	// Setup HTTP client with custom cert bundle if enabled
-	if opts.CustomCABundle != nil {
-		if err := loadCustomCABundle(s, opts.CustomCABundle); err != nil {
-			return nil, err
-		}
-	}
-
 	return s, nil
 }
 
@@ -483,22 +551,83 @@ func loadCSMConfig(envCfg envConfig, cfgFiles []string) (csmConfig, error) {
 	return csmConfig{}, nil
 }
 
-func loadCustomCABundle(s *Session, bundle io.Reader) error {
+func setTLSOptions(opts *Options, cfg *aws.Config, envCfg envConfig, sharedCfg sharedConfig) error {
+	// CA Bundle can be specified in both environment variable shared config file.
+	var caBundleFilename = envCfg.CustomCABundle
+	if len(caBundleFilename) == 0 {
+		caBundleFilename = sharedCfg.CustomCABundle
+	}
+
+	// Only use environment value if session option is not provided.
+	customTLSOptions := map[string]struct {
+		filename string
+		field    *io.Reader
+		errCode  string
+	}{
+		"custom CA bundle PEM":   {filename: caBundleFilename, field: &opts.CustomCABundle, errCode: ErrCodeLoadCustomCABundle},
+		"custom client TLS cert": {filename: envCfg.ClientTLSCert, field: &opts.ClientTLSCert, errCode: ErrCodeLoadClientTLSCert},
+		"custom client TLS key":  {filename: envCfg.ClientTLSKey, field: &opts.ClientTLSKey, errCode: ErrCodeLoadClientTLSCert},
+	}
+	for name, v := range customTLSOptions {
+		if len(v.filename) != 0 && *v.field == nil {
+			f, err := os.Open(v.filename)
+			if err != nil {
+				return awserr.New(v.errCode, fmt.Sprintf("failed to open %s file", name), err)
+			}
+			defer f.Close()
+			*v.field = f
+		}
+	}
+
+	// Setup HTTP client with custom cert bundle if enabled
+	if opts.CustomCABundle != nil {
+		if err := loadCustomCABundle(cfg.HTTPClient, opts.CustomCABundle); err != nil {
+			return err
+		}
+	}
+
+	// Setup HTTP client TLS certificate and key for client TLS authentication.
+	if opts.ClientTLSCert != nil && opts.ClientTLSKey != nil {
+		if err := loadClientTLSCert(cfg.HTTPClient, opts.ClientTLSCert, opts.ClientTLSKey); err != nil {
+			return err
+		}
+	} else if opts.ClientTLSCert == nil && opts.ClientTLSKey == nil {
+		// Do nothing if neither values are available.
+
+	} else {
+		return awserr.New(ErrCodeLoadClientTLSCert,
+			fmt.Sprintf("client TLS cert(%t) and key(%t) must both be provided",
+				opts.ClientTLSCert != nil, opts.ClientTLSKey != nil), nil)
+	}
+
+	return nil
+}
+
+func getHTTPTransport(client *http.Client) (*http.Transport, error) {
 	var t *http.Transport
-	switch v := s.Config.HTTPClient.Transport.(type) {
+	switch v := client.Transport.(type) {
 	case *http.Transport:
 		t = v
 	default:
-		if s.Config.HTTPClient.Transport != nil {
-			return awserr.New("LoadCustomCABundleError",
-				"unable to load custom CA bundle, HTTPClient's transport unsupported type", nil)
+		if client.Transport != nil {
+			return nil, fmt.Errorf("unsupported transport, %T", client.Transport)
 		}
 	}
 	if t == nil {
 		// Nil transport implies `http.DefaultTransport` should be used. Since
 		// the SDK cannot modify, nor copy the `DefaultTransport` specifying
 		// the values the next closest behavior.
-		t = getCABundleTransport()
+		t = getCustomTransport()
+	}
+
+	return t, nil
+}
+
+func loadCustomCABundle(client *http.Client, bundle io.Reader) error {
+	t, err := getHTTPTransport(client)
+	if err != nil {
+		return awserr.New(ErrCodeLoadCustomCABundle,
+			"unable to load custom CA bundle, HTTPClient's transport unsupported type", err)
 	}
 
 	p, err := loadCertPool(bundle)
@@ -510,7 +639,7 @@ func loadCustomCABundle(s *Session, bundle io.Reader) error {
 	}
 	t.TLSClientConfig.RootCAs = p
 
-	s.Config.HTTPClient.Transport = t
+	client.Transport = t
 
 	return nil
 }
@@ -518,19 +647,57 @@ func loadCustomCABundle(s *Session, bundle io.Reader) error {
 func loadCertPool(r io.Reader) (*x509.CertPool, error) {
 	b, err := ioutil.ReadAll(r)
 	if err != nil {
-		return nil, awserr.New("LoadCustomCABundleError",
+		return nil, awserr.New(ErrCodeLoadCustomCABundle,
 			"failed to read custom CA bundle PEM file", err)
 	}
 
 	p := x509.NewCertPool()
 	if !p.AppendCertsFromPEM(b) {
-		return nil, awserr.New("LoadCustomCABundleError",
+		return nil, awserr.New(ErrCodeLoadCustomCABundle,
 			"failed to load custom CA bundle PEM file", err)
 	}
 
 	return p, nil
 }
 
+func loadClientTLSCert(client *http.Client, certFile, keyFile io.Reader) error {
+	t, err := getHTTPTransport(client)
+	if err != nil {
+		return awserr.New(ErrCodeLoadClientTLSCert,
+			"unable to get usable HTTP transport from client", err)
+	}
+
+	cert, err := ioutil.ReadAll(certFile)
+	if err != nil {
+		return awserr.New(ErrCodeLoadClientTLSCert,
+			"unable to get read client TLS cert file", err)
+	}
+
+	key, err := ioutil.ReadAll(keyFile)
+	if err != nil {
+		return awserr.New(ErrCodeLoadClientTLSCert,
+			"unable to get read client TLS key file", err)
+	}
+
+	clientCert, err := tls.X509KeyPair(cert, key)
+	if err != nil {
+		return awserr.New(ErrCodeLoadClientTLSCert,
+			"unable to load x509 key pair from client cert", err)
+	}
+
+	tlsCfg := t.TLSClientConfig
+	if tlsCfg == nil {
+		tlsCfg = &tls.Config{}
+	}
+
+	tlsCfg.Certificates = append(tlsCfg.Certificates, clientCert)
+
+	t.TLSClientConfig = tlsCfg
+	client.Transport = t
+
+	return nil
+}
+
 func mergeConfigSrcs(cfg, userCfg *aws.Config,
 	envCfg envConfig, sharedCfg sharedConfig,
 	handlers request.Handlers,
@@ -570,6 +737,14 @@ func mergeConfigSrcs(cfg, userCfg *aws.Config,
 		endpoints.LegacyS3UsEast1Endpoint,
 	})
 
+	ec2IMDSEndpoint := sessOpts.EC2IMDSEndpoint
+	if len(ec2IMDSEndpoint) == 0 {
+		ec2IMDSEndpoint = envCfg.EC2IMDSEndpoint
+	}
+	if len(ec2IMDSEndpoint) != 0 {
+		cfg.EndpointResolver = wrapEC2IMDSEndpoint(cfg.EndpointResolver, ec2IMDSEndpoint)
+	}
+
 	// Configure credentials if not already set by the user when creating the
 	// Session.
 	if cfg.Credentials == credentials.AnonymousCredentials && userCfg.Credentials == nil {
@@ -627,6 +802,7 @@ func (s *Session) Copy(cfgs ...*aws.Config) *Session {
 	newSession := &Session{
 		Config:   s.Config.Copy(cfgs...),
 		Handlers: s.Handlers.Copy(),
+		options:  s.options,
 	}
 
 	initHandlers(newSession)
@@ -665,6 +841,8 @@ func (s *Session) ClientConfig(service string, cfgs ...*aws.Config) client.Confi
 	}
 }
 
+const ec2MetadataServiceID = "ec2metadata"
+
 func (s *Session) resolveEndpoint(service, region string, cfg *aws.Config) (endpoints.ResolvedEndpoint, error) {
 
 	if ep := aws.StringValue(cfg.Endpoint); len(ep) != 0 {

vendor/github.com/aws/aws-sdk-go/aws/session/shared_config.go

@@ -34,6 +34,9 @@ const (
 	// Additional Config fields
 	regionKey = `region`
 
+	// custom CA Bundle filename
+	customCABundleKey = `ca_bundle`
+
 	// endpoint discovery group
 	enableEndpointDiscoveryKey = `endpoint_discovery_enabled` // optional
 
@@ -90,6 +93,15 @@ type sharedConfig struct {
 	//	region
 	Region string
 
+	// CustomCABundle is the file path to a PEM file the SDK will read and
+	// use to configure the HTTP transport with additional CA certs that are
+	// not present in the platforms default CA store.
+	//
+	// This value will be ignored if the file does not exist.
+	//
+	//  ca_bundle
+	CustomCABundle string
+
 	// EnableEndpointDiscovery can be enabled in the shared config by setting
 	// endpoint_discovery_enabled to true
 	//
@@ -276,6 +288,7 @@ func (cfg *sharedConfig) setFromIniFile(profile string, file sharedConfigFile, e
 		updateString(&cfg.SourceProfileName, section, sourceProfileKey)
 		updateString(&cfg.CredentialSource, section, credentialSourceKey)
 		updateString(&cfg.Region, section, regionKey)
+		updateString(&cfg.CustomCABundle, section, customCABundleKey)
 
 		if section.Has(roleDurationSecondsKey) {
 			d := time.Duration(section.Int(roleDurationSecondsKey)) * time.Second

vendor/github.com/aws/aws-sdk-go/aws/types.go

@@ -239,3 +239,26 @@ func (es errors) Error() string {
 
 	return strings.Join(parts, "\n")
 }
+
+// CopySeekableBody copies the seekable body to an io.Writer
+func CopySeekableBody(dst io.Writer, src io.ReadSeeker) (int64, error) {
+	curPos, err := src.Seek(0, sdkio.SeekCurrent)
+	if err != nil {
+		return 0, err
+	}
+
+	// copy errors may be assumed to be from the body.
+	n, err := io.Copy(dst, src)
+	if err != nil {
+		return n, err
+	}
+
+	// seek back to the first position after reading to reset
+	// the body for transmission.
+	_, err = src.Seek(curPos, sdkio.SeekStart)
+	if err != nil {
+		return n, err
+	}
+
+	return n, nil
+}

vendor/github.com/aws/aws-sdk-go/aws/version.go

@@ -5,4 +5,4 @@ package aws
 const SDKName = "aws-sdk-go"
 
 // SDKVersion is the version of this SDK
-const SDKVersion = "1.30.29"
+const SDKVersion = "1.36.31"

vendor/github.com/aws/aws-sdk-go/internal/ini/ini_parser.go

@@ -63,9 +63,10 @@ var parseTable = map[ASTKind]map[TokenType]int{
 		TokenNone:    MarkCompleteState,
 	},
 	ASTKindEqualExpr: map[TokenType]int{
-		TokenLit: ValueState,
-		TokenWS:  SkipTokenState,
-		TokenNL:  SkipState,
+		TokenLit:     ValueState,
+		TokenWS:      SkipTokenState,
+		TokenNL:      SkipState,
+		TokenNone:    SkipState,
 	},
 	ASTKindStatement: map[TokenType]int{
 		TokenLit:     SectionState,

vendor/github.com/aws/aws-sdk-go/internal/s3shared/arn/accesspoint_arn.go

@@ -19,23 +19,28 @@ func (a AccessPointARN) GetARN() arn.ARN {
 
 // ParseAccessPointResource attempts to parse the ARN's resource as an
 // AccessPoint resource.
+//
+// Supported Access point resource format:
+//	- Access point format: arn:{partition}:s3:{region}:{accountId}:accesspoint/{accesspointName}
+//	- example: arn.aws.s3.us-west-2.012345678901:accesspoint/myaccesspoint
+//
 func ParseAccessPointResource(a arn.ARN, resParts []string) (AccessPointARN, error) {
 	if len(a.Region) == 0 {
-		return AccessPointARN{}, InvalidARNError{a, "region not set"}
+		return AccessPointARN{}, InvalidARNError{ARN: a, Reason: "region not set"}
 	}
 	if len(a.AccountID) == 0 {
-		return AccessPointARN{}, InvalidARNError{a, "account-id not set"}
+		return AccessPointARN{}, InvalidARNError{ARN: a, Reason: "account-id not set"}
 	}
 	if len(resParts) == 0 {
-		return AccessPointARN{}, InvalidARNError{a, "resource-id not set"}
+		return AccessPointARN{}, InvalidARNError{ARN: a, Reason: "resource-id not set"}
 	}
 	if len(resParts) > 1 {
-		return AccessPointARN{}, InvalidARNError{a, "sub resource not supported"}
+		return AccessPointARN{}, InvalidARNError{ARN: a, Reason: "sub resource not supported"}
 	}
 
 	resID := resParts[0]
 	if len(strings.TrimSpace(resID)) == 0 {
-		return AccessPointARN{}, InvalidARNError{a, "resource-id not set"}
+		return AccessPointARN{}, InvalidARNError{ARN: a, Reason: "resource-id not set"}
 	}
 
 	return AccessPointARN{

vendor/github.com/aws/aws-sdk-go/internal/s3shared/arn/arn.go

@@ -1,6 +1,7 @@
 package arn
 
 import (
+	"fmt"
 	"strings"
 
 	"github.com/aws/aws-sdk-go/aws/arn"
@@ -25,13 +26,14 @@ func ParseResource(s string, resParser ResourceParser) (resARN Resource, err err
 	}
 
 	if len(a.Partition) == 0 {
-		return nil, InvalidARNError{a, "partition not set"}
+		return nil, InvalidARNError{ARN: a, Reason: "partition not set"}
 	}
-	if a.Service != "s3" {
-		return nil, InvalidARNError{a, "service is not S3"}
+
+	if a.Service != "s3" && a.Service != "s3-outposts" {
+		return nil, InvalidARNError{ARN: a, Reason: "service is not supported"}
 	}
 	if len(a.Resource) == 0 {
-		return nil, InvalidARNError{a, "resource not set"}
+		return nil, InvalidARNError{ARN: a, Reason: "resource not set"}
 	}
 
 	return resParser(a)
@@ -66,6 +68,7 @@ type InvalidARNError struct {
 	Reason string
 }
 
+// Error returns a string denoting the occurred InvalidARNError
 func (e InvalidARNError) Error() string {
-	return "invalid Amazon S3 ARN, " + e.Reason + ", " + e.ARN.String()
+	return fmt.Sprintf("invalid Amazon %s ARN, %s, %s", e.ARN.Service, e.Reason, e.ARN.String())
 }

vendor/github.com/aws/aws-sdk-go/internal/s3shared/arn/outpost_arn.go

@@ -0,0 +1,126 @@
+package arn
+
+import (
+	"strings"
+
+	"github.com/aws/aws-sdk-go/aws/arn"
+)
+
+// OutpostARN interface that should be satisfied by outpost ARNs
+type OutpostARN interface {
+	Resource
+	GetOutpostID() string
+}
+
+// ParseOutpostARNResource will parse a provided ARNs resource using the appropriate ARN format
+// and return a specific OutpostARN type
+//
+// Currently supported outpost ARN formats:
+// * Outpost AccessPoint ARN format:
+//		- ARN format: arn:{partition}:s3-outposts:{region}:{accountId}:outpost/{outpostId}/accesspoint/{accesspointName}
+//		- example: arn:aws:s3-outposts:us-west-2:012345678901:outpost/op-1234567890123456/accesspoint/myaccesspoint
+//
+// * Outpost Bucket ARN format:
+// 		- ARN format: arn:{partition}:s3-outposts:{region}:{accountId}:outpost/{outpostId}/bucket/{bucketName}
+//		- example: arn:aws:s3-outposts:us-west-2:012345678901:outpost/op-1234567890123456/bucket/mybucket
+//
+// Other outpost ARN formats may be supported and added in the future.
+//
+func ParseOutpostARNResource(a arn.ARN, resParts []string) (OutpostARN, error) {
+	if len(a.Region) == 0 {
+		return nil, InvalidARNError{ARN: a, Reason: "region not set"}
+	}
+
+	if len(a.AccountID) == 0 {
+		return nil, InvalidARNError{ARN: a, Reason: "account-id not set"}
+	}
+
+	// verify if outpost id is present and valid
+	if len(resParts) == 0 || len(strings.TrimSpace(resParts[0])) == 0 {
+		return nil, InvalidARNError{ARN: a, Reason: "outpost resource-id not set"}
+	}
+
+	// verify possible resource type exists
+	if len(resParts) < 3 {
+		return nil, InvalidARNError{
+			ARN: a, Reason: "incomplete outpost resource type. Expected bucket or access-point resource to be present",
+		}
+	}
+
+	// Since we know this is a OutpostARN fetch outpostID
+	outpostID := strings.TrimSpace(resParts[0])
+
+	switch resParts[1] {
+	case "accesspoint":
+		accesspointARN, err := ParseAccessPointResource(a, resParts[2:])
+		if err != nil {
+			return OutpostAccessPointARN{}, err
+		}
+		return OutpostAccessPointARN{
+			AccessPointARN: accesspointARN,
+			OutpostID:      outpostID,
+		}, nil
+
+	case "bucket":
+		bucketName, err := parseBucketResource(a, resParts[2:])
+		if err != nil {
+			return nil, err
+		}
+		return OutpostBucketARN{
+			ARN:        a,
+			BucketName: bucketName,
+			OutpostID:  outpostID,
+		}, nil
+
+	default:
+		return nil, InvalidARNError{ARN: a, Reason: "unknown resource set for outpost ARN"}
+	}
+}
+
+// OutpostAccessPointARN represents outpost access point ARN.
+type OutpostAccessPointARN struct {
+	AccessPointARN
+	OutpostID string
+}
+
+// GetOutpostID returns the outpost id of outpost access point arn
+func (o OutpostAccessPointARN) GetOutpostID() string {
+	return o.OutpostID
+}
+
+// OutpostBucketARN represents the outpost bucket ARN.
+type OutpostBucketARN struct {
+	arn.ARN
+	BucketName string
+	OutpostID  string
+}
+
+// GetOutpostID returns the outpost id of outpost bucket arn
+func (o OutpostBucketARN) GetOutpostID() string {
+	return o.OutpostID
+}
+
+// GetARN retrives the base ARN from outpost bucket ARN resource
+func (o OutpostBucketARN) GetARN() arn.ARN {
+	return o.ARN
+}
+
+// parseBucketResource attempts to parse the ARN's bucket resource and retrieve the
+// bucket resource id.
+//
+// parseBucketResource only parses the bucket resource id.
+//
+func parseBucketResource(a arn.ARN, resParts []string) (bucketName string, err error) {
+	if len(resParts) == 0 {
+		return bucketName, InvalidARNError{ARN: a, Reason: "bucket resource-id not set"}
+	}
+	if len(resParts) > 1 {
+		return bucketName, InvalidARNError{ARN: a, Reason: "sub resource not supported"}
+	}
+
+	bucketName = strings.TrimSpace(resParts[0])
+	if len(bucketName) == 0 {
+		return bucketName, InvalidARNError{ARN: a, Reason: "bucket resource-id not set"}
+	}
+	return bucketName, err
+}

vendor/github.com/aws/aws-sdk-go/internal/s3shared/endpoint_errors.go

@@ -0,0 +1,189 @@
+package s3shared
+
+import (
+	"fmt"
+
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/internal/s3shared/arn"
+)
+
+const (
+	invalidARNErrorErrCode    = "InvalidARNError"
+	configurationErrorErrCode = "ConfigurationError"
+)
+
+// InvalidARNError denotes the error for Invalid ARN
+type InvalidARNError struct {
+	message  string
+	resource arn.Resource
+	origErr  error
+}
+
+// Error returns the InvalidARNError
+func (e InvalidARNError) Error() string {
+	var extra string
+	if e.resource != nil {
+		extra = "ARN: " + e.resource.String()
+	}
+	return awserr.SprintError(e.Code(), e.Message(), extra, e.origErr)
+}
+
+// Code returns the invalid ARN error code
+func (e InvalidARNError) Code() string {
+	return invalidARNErrorErrCode
+}
+
+// Message returns the message for Invalid ARN error
+func (e InvalidARNError) Message() string {
+	return e.message
+}
+
+// OrigErr is the original error wrapped by Invalid ARN Error
+func (e InvalidARNError) OrigErr() error {
+	return e.origErr
+}
+
+// NewInvalidARNError denotes invalid arn error
+func NewInvalidARNError(resource arn.Resource, err error) InvalidARNError {
+	return InvalidARNError{
+		message:  "invalid ARN",
+		origErr:  err,
+		resource: resource,
+	}
+}
+
+// NewInvalidARNWithCustomEndpointError ARN not supported for custom clients endpoints
+func NewInvalidARNWithCustomEndpointError(resource arn.Resource, err error) InvalidARNError {
+	return InvalidARNError{
+		message:  "resource ARN not supported with custom client endpoints",
+		origErr:  err,
+		resource: resource,
+	}
+}
+
+// NewInvalidARNWithUnsupportedPartitionError ARN not supported for the target partition
+func NewInvalidARNWithUnsupportedPartitionError(resource arn.Resource, err error) InvalidARNError {
+	return InvalidARNError{
+		message:  "resource ARN not supported for the target ARN partition",
+		origErr:  err,
+		resource: resource,
+	}
+}
+
+// NewInvalidARNWithFIPSError ARN not supported for FIPS region
+func NewInvalidARNWithFIPSError(resource arn.Resource, err error) InvalidARNError {
+	return InvalidARNError{
+		message:  "resource ARN not supported for FIPS region",
+		resource: resource,
+		origErr:  err,
+	}
+}
+
+// ConfigurationError is used to denote a client configuration error
+type ConfigurationError struct {
+	message           string
+	resource          arn.Resource
+	clientPartitionID string
+	clientRegion      string
+	origErr           error
+}
+
+// Error returns the Configuration error string
+func (e ConfigurationError) Error() string {
+	extra := fmt.Sprintf("ARN: %s, client partition: %s, client region: %s",
+		e.resource, e.clientPartitionID, e.clientRegion)
+
+	return awserr.SprintError(e.Code(), e.Message(), extra, e.origErr)
+}
+
+// Code returns configuration error's error-code
+func (e ConfigurationError) Code() string {
+	return configurationErrorErrCode
+}
+
+// Message returns the configuration error message
+func (e ConfigurationError) Message() string {
+	return e.message
+}
+
+// OrigErr is the original error wrapped by Configuration Error
+func (e ConfigurationError) OrigErr() error {
+	return e.origErr
+}
+
+// NewClientPartitionMismatchError  stub
+func NewClientPartitionMismatchError(resource arn.Resource, clientPartitionID, clientRegion string, err error) ConfigurationError {
+	return ConfigurationError{
+		message:           "client partition does not match provided ARN partition",
+		origErr:           err,
+		resource:          resource,
+		clientPartitionID: clientPartitionID,
+		clientRegion:      clientRegion,
+	}
+}
+
+// NewClientRegionMismatchError denotes cross region access error
+func NewClientRegionMismatchError(resource arn.Resource, clientPartitionID, clientRegion string, err error) ConfigurationError {
+	return ConfigurationError{
+		message:           "client region does not match provided ARN region",
+		origErr:           err,
+		resource:          resource,
+		clientPartitionID: clientPartitionID,
+		clientRegion:      clientRegion,
+	}
+}
+
+// NewFailedToResolveEndpointError denotes endpoint resolving error
+func NewFailedToResolveEndpointError(resource arn.Resource, clientPartitionID, clientRegion string, err error) ConfigurationError {
+	return ConfigurationError{
+		message:           "endpoint resolver failed to find an endpoint for the provided ARN region",
+		origErr:           err,
+		resource:          resource,
+		clientPartitionID: clientPartitionID,
+		clientRegion:      clientRegion,
+	}
+}
+
+// NewClientConfiguredForFIPSError denotes client config error for unsupported cross region FIPS access
+func NewClientConfiguredForFIPSError(resource arn.Resource, clientPartitionID, clientRegion string, err error) ConfigurationError {
+	return ConfigurationError{
+		message:           "client configured for fips but cross-region resource ARN provided",
+		origErr:           err,
+		resource:          resource,
+		clientPartitionID: clientPartitionID,
+		clientRegion:      clientRegion,
+	}
+}
+
+// NewClientConfiguredForAccelerateError denotes client config error for unsupported S3 accelerate
+func NewClientConfiguredForAccelerateError(resource arn.Resource, clientPartitionID, clientRegion string, err error) ConfigurationError {
+	return ConfigurationError{
+		message:           "client configured for S3 Accelerate but is not supported with resource ARN",
+		origErr:           err,
+		resource:          resource,
+		clientPartitionID: clientPartitionID,
+		clientRegion:      clientRegion,
+	}
+}
+
+// NewClientConfiguredForCrossRegionFIPSError denotes client config error for unsupported cross region FIPS request
+func NewClientConfiguredForCrossRegionFIPSError(resource arn.Resource, clientPartitionID, clientRegion string, err error) ConfigurationError {
+	return ConfigurationError{
+		message:           "client configured for FIPS with cross-region enabled but is supported with cross-region resource ARN",
+		origErr:           err,
+		resource:          resource,
+		clientPartitionID: clientPartitionID,
+		clientRegion:      clientRegion,
+	}
+}
+
+// NewClientConfiguredForDualStackError denotes client config error for unsupported S3 Dual-stack
+func NewClientConfiguredForDualStackError(resource arn.Resource, clientPartitionID, clientRegion string, err error) ConfigurationError {
+	return ConfigurationError{
+		message:           "client configured for S3 Dual-stack but is not supported with resource ARN",
+		origErr:           err,
+		resource:          resource,
+		clientPartitionID: clientPartitionID,
+		clientRegion:      clientRegion,
+	}
+}

vendor/github.com/aws/aws-sdk-go/internal/s3shared/resource_request.go

@@ -0,0 +1,62 @@
+package s3shared
+
+import (
+	"strings"
+
+	"github.com/aws/aws-sdk-go/aws"
+	awsarn "github.com/aws/aws-sdk-go/aws/arn"
+	"github.com/aws/aws-sdk-go/aws/request"
+	"github.com/aws/aws-sdk-go/internal/s3shared/arn"
+)
+
+// ResourceRequest represents the request and arn resource
+type ResourceRequest struct {
+	Resource arn.Resource
+	Request  *request.Request
+}
+
+// ARN returns the resource ARN
+func (r ResourceRequest) ARN() awsarn.ARN {
+	return r.Resource.GetARN()
+}
+
+// AllowCrossRegion returns a bool value to denote if S3UseARNRegion flag is set
+func (r ResourceRequest) AllowCrossRegion() bool {
+	return aws.BoolValue(r.Request.Config.S3UseARNRegion)
+}
+
+// UseFIPS returns true if request config region is FIPS
+func (r ResourceRequest) UseFIPS() bool {
+	return IsFIPS(aws.StringValue(r.Request.Config.Region))
+}
+
+// ResourceConfiguredForFIPS returns true if resource ARNs region is FIPS
+func (r ResourceRequest) ResourceConfiguredForFIPS() bool {
+	return IsFIPS(r.ARN().Region)
+}
+
+// IsCrossPartition returns true if client is configured for another partition, than
+// the partition that resource ARN region resolves to.
+func (r ResourceRequest) IsCrossPartition() bool {
+	return r.Request.ClientInfo.PartitionID != r.Resource.GetARN().Partition
+}
+
+// IsCrossRegion returns true if ARN region is different than client configured region
+func (r ResourceRequest) IsCrossRegion() bool {
+	return IsCrossRegion(r.Request, r.Resource.GetARN().Region)
+}
+
+// HasCustomEndpoint returns true if custom client endpoint is provided
+func (r ResourceRequest) HasCustomEndpoint() bool {
+	return len(aws.StringValue(r.Request.Config.Endpoint)) > 0
+}
+
+// IsFIPS returns true if region is a fips region
+func IsFIPS(clientRegion string) bool {
+	return strings.HasPrefix(clientRegion, "fips-") || strings.HasSuffix(clientRegion, "-fips")
+}
+
+// IsCrossRegion returns true if request signing region is not same as configured region
+func IsCrossRegion(req *request.Request, otherRegion string) bool {
+	return req.ClientInfo.SigningRegion != otherRegion
+}

vendor/github.com/aws/aws-sdk-go/private/checksum/content_md5.go

@@ -0,0 +1,53 @@
+package checksum
+
+import (
+	"crypto/md5"
+	"encoding/base64"
+	"fmt"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/aws/request"
+)
+
+const contentMD5Header = "Content-Md5"
+
+// AddBodyContentMD5Handler computes and sets the HTTP Content-MD5 header for requests that
+// require it.
+func AddBodyContentMD5Handler(r *request.Request) {
+	// if Content-MD5 header is already present, return
+	if v := r.HTTPRequest.Header.Get(contentMD5Header); len(v) != 0 {
+		return
+	}
+
+	// if S3DisableContentMD5Validation flag is set, return
+	if aws.BoolValue(r.Config.S3DisableContentMD5Validation) {
+		return
+	}
+
+	// if request is presigned, return
+	if r.IsPresigned() {
+		return
+	}
+
+	// if body is not seekable, return
+	if !aws.IsReaderSeekable(r.Body) {
+		if r.Config.Logger != nil {
+			r.Config.Logger.Log(fmt.Sprintf(
+				"Unable to compute Content-MD5 for unseekable body, S3.%s",
+				r.Operation.Name))
+		}
+		return
+	}
+
+	h := md5.New()
+
+	if _, err := aws.CopySeekableBody(h, r.Body); err != nil {
+		r.Error = awserr.New("ContentMD5", "failed to compute body MD5", err)
+		return
+	}
+
+	// encode the md5 checksum in base64 and set the request header.
+	v := base64.StdEncoding.EncodeToString(h.Sum(nil))
+	r.HTTPRequest.Header.Set(contentMD5Header, v)
+}

vendor/github.com/aws/aws-sdk-go/private/protocol/eventstream/eventstreamapi/reader.go

@@ -69,10 +69,23 @@ func (r *EventReader) ReadEvent() (event interface{}, err error) {
 	case ErrorMessageType:
 		return nil, r.unmarshalErrorMessage(msg)
 	default:
-		return nil, fmt.Errorf("unknown eventstream message type, %v", typ)
+		return nil, &UnknownMessageTypeError{
+			Type: typ, Message: msg.Clone(),
+		}
 	}
 }
 
+// UnknownMessageTypeError provides an error when a message is received from
+// the stream, but the reader is unable to determine what kind of message it is.
+type UnknownMessageTypeError struct {
+	Type    string
+	Message eventstream.Message
+}
+
+func (e *UnknownMessageTypeError) Error() string {
+	return "unknown eventstream message type, " + e.Type
+}
+
 func (r *EventReader) unmarshalEventMessage(
 	msg eventstream.Message,
 ) (event interface{}, err error) {

vendor/github.com/aws/aws-sdk-go/private/protocol/eventstream/header.go

@@ -52,6 +52,15 @@ func (hs *Headers) Del(name string) {
 	}
 }
 
+// Clone returns a deep copy of the headers
+func (hs Headers) Clone() Headers {
+	o := make(Headers, 0, len(hs))
+	for _, h := range hs {
+		o.Set(h.Name, h.Value)
+	}
+	return o
+}
+
 func decodeHeaders(r io.Reader) (Headers, error) {
 	hs := Headers{}
 

vendor/github.com/aws/aws-sdk-go/private/protocol/eventstream/message.go

@@ -57,6 +57,20 @@ func (m *Message) rawMessage() (rawMessage, error) {
 	return raw, nil
 }
 
+// Clone returns a deep copy of the message.
+func (m Message) Clone() Message {
+	var payload []byte
+	if m.Payload != nil {
+		payload = make([]byte, len(m.Payload))
+		copy(payload, m.Payload)
+	}
+
+	return Message{
+		Headers: m.Headers.Clone(),
+		Payload: payload,
+	}
+}
+
 type messagePrelude struct {
 	Length     uint32
 	HeadersLen uint32

vendor/github.com/aws/aws-sdk-go/private/protocol/host.go

@@ -1,9 +1,10 @@
 package protocol
 
 import (
-	"strings"
-
 	"github.com/aws/aws-sdk-go/aws/request"
+	"net"
+	"strconv"
+	"strings"
 )
 
 // ValidateEndpointHostHandler is a request handler that will validate the
@@ -22,8 +23,26 @@ var ValidateEndpointHostHandler = request.NamedHandler{
 // 3986 host. Returns error if the host is not valid.
 func ValidateEndpointHost(opName, host string) error {
 	paramErrs := request.ErrInvalidParams{Context: opName}
-	labels := strings.Split(host, ".")
 
+	var hostname string
+	var port string
+	var err error
+
+	if strings.Contains(host, ":") {
+		hostname, port, err = net.SplitHostPort(host)
+
+		if err != nil {
+			paramErrs.Add(request.NewErrParamFormat("endpoint", err.Error(), host))
+		}
+
+		if !ValidPortNumber(port) {
+			paramErrs.Add(request.NewErrParamFormat("endpoint port number", "[0-65535]", port))
+		}
+	} else {
+		hostname = host
+	}
+
+	labels := strings.Split(hostname, ".")
 	for i, label := range labels {
 		if i == len(labels)-1 && len(label) == 0 {
 			// Allow trailing dot for FQDN hosts.
@@ -36,7 +55,11 @@ func ValidateEndpointHost(opName, host string) error {
 		}
 	}
 
-	if len(host) > 255 {
+	if len(hostname) == 0 {
+		paramErrs.Add(request.NewErrParamMinLen("endpoint host", 1))
+	}
+
+	if len(hostname) > 255 {
 		paramErrs.Add(request.NewErrParamMaxLen(
 			"endpoint host", 255, host,
 		))
@@ -66,3 +89,16 @@ func ValidHostLabel(label string) bool {
 
 	return true
 }
+
+// ValidPortNumber return if the port is valid RFC 3986 port
+func ValidPortNumber(port string) bool {
+	i, err := strconv.Atoi(port)
+	if err != nil {
+		return false
+	}
+
+	if i < 0 || i > 65535 {
+		return false
+	}
+	return true
+}

vendor/github.com/aws/aws-sdk-go/private/protocol/json/jsonutil/unmarshal.go

@@ -6,6 +6,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
+	"math/big"
 	"reflect"
 	"strings"
 	"time"
@@ -15,6 +16,8 @@ import (
 	"github.com/aws/aws-sdk-go/private/protocol"
 )
 
+var millisecondsFloat = new(big.Float).SetInt64(1e3)
+
 // UnmarshalJSONError unmarshal's the reader's JSON document into the passed in
 // type. The value to unmarshal the json document into must be a pointer to the
 // type.
@@ -39,7 +42,9 @@ func UnmarshalJSONError(v interface{}, stream io.Reader) error {
 func UnmarshalJSON(v interface{}, stream io.Reader) error {
 	var out interface{}
 
-	err := json.NewDecoder(stream).Decode(&out)
+	decoder := json.NewDecoder(stream)
+	decoder.UseNumber()
+	err := decoder.Decode(&out)
 	if err == io.EOF {
 		return nil
 	} else if err != nil {
@@ -54,7 +59,9 @@ func UnmarshalJSON(v interface{}, stream io.Reader) error {
 func UnmarshalJSONCaseInsensitive(v interface{}, stream io.Reader) error {
 	var out interface{}
 
-	err := json.NewDecoder(stream).Decode(&out)
+	decoder := json.NewDecoder(stream)
+	decoder.UseNumber()
+	err := decoder.Decode(&out)
 	if err == io.EOF {
 		return nil
 	} else if err != nil {
@@ -254,16 +261,31 @@ func (u unmarshaler) unmarshalScalar(value reflect.Value, data interface{}, tag
 		default:
 			return fmt.Errorf("unsupported value: %v (%s)", value.Interface(), value.Type())
 		}
-	case float64:
+	case json.Number:
 		switch value.Interface().(type) {
 		case *int64:
-			di := int64(d)
+			// Retain the old behavior where we would just truncate the float64
+			// calling d.Int64() here could cause an invalid syntax error due to the usage of strconv.ParseInt
+			f, err := d.Float64()
+			if err != nil {
+				return err
+			}
+			di := int64(f)
 			value.Set(reflect.ValueOf(&di))
 		case *float64:
-			value.Set(reflect.ValueOf(&d))
+			f, err := d.Float64()
+			if err != nil {
+				return err
+			}
+			value.Set(reflect.ValueOf(&f))
 		case *time.Time:
-			// Time unmarshaled from a float64 can only be epoch seconds
-			t := time.Unix(int64(d), 0).UTC()
+			float, ok := new(big.Float).SetString(d.String())
+			if !ok {
+				return fmt.Errorf("unsupported float time representation: %v", d.String())
+			}
+			float = float.Mul(float, millisecondsFloat)
+			ms, _ := float.Int64()
+			t := time.Unix(0, ms*1e6).UTC()
 			value.Set(reflect.ValueOf(&t))
 		default:
 			return fmt.Errorf("unsupported value: %v (%s)", value.Interface(), value.Type())

vendor/github.com/aws/aws-sdk-go/private/protocol/timestamp.go

@@ -27,8 +27,8 @@ const (
 	// RFC3339 a subset of the ISO8601 timestamp format. e.g 2014-04-29T18:30:38Z
 	ISO8601TimeFormat = "2006-01-02T15:04:05.999999999Z"
 
-	// This format is used for output time without seconds precision
-	ISO8601OutputTimeFormat = "2006-01-02T15:04:05Z"
+	// This format is used for output time with fractional second precision up to milliseconds
+	ISO8601OutputTimeFormat = "2006-01-02T15:04:05.999999999Z"
 )
 
 // IsKnownTimestampFormat returns if the timestamp format name
@@ -48,7 +48,7 @@ func IsKnownTimestampFormat(name string) bool {
 
 // FormatTime returns a string value of the time.
 func FormatTime(name string, t time.Time) string {
-	t = t.UTC()
+	t = t.UTC().Truncate(time.Millisecond)
 
 	switch name {
 	case RFC822TimeFormatName:
@@ -56,7 +56,8 @@ func FormatTime(name string, t time.Time) string {
 	case ISO8601TimeFormatName:
 		return t.Format(ISO8601OutputTimeFormat)
 	case UnixTimeFormatName:
-		return strconv.FormatInt(t.Unix(), 10)
+		ms := t.UnixNano() / int64(time.Millisecond)
+		return strconv.FormatFloat(float64(ms)/1e3, 'f', -1, 64)
 	default:
 		panic("unknown timestamp format name, " + name)
 	}

vendor/github.com/aws/aws-sdk-go/service/acm/api.go

@@ -4142,6 +4142,19 @@ const (
 	CertificateStatusFailed = "FAILED"
 )
 
+// CertificateStatus_Values returns all elements of the CertificateStatus enum
+func CertificateStatus_Values() []string {
+	return []string{
+		CertificateStatusPendingValidation,
+		CertificateStatusIssued,
+		CertificateStatusInactive,
+		CertificateStatusExpired,
+		CertificateStatusValidationTimedOut,
+		CertificateStatusRevoked,
+		CertificateStatusFailed,
+	}
+}
+
 const (
 	// CertificateTransparencyLoggingPreferenceEnabled is a CertificateTransparencyLoggingPreference enum value
 	CertificateTransparencyLoggingPreferenceEnabled = "ENABLED"
@@ -4150,6 +4163,14 @@ const (
 	CertificateTransparencyLoggingPreferenceDisabled = "DISABLED"
 )
 
+// CertificateTransparencyLoggingPreference_Values returns all elements of the CertificateTransparencyLoggingPreference enum
+func CertificateTransparencyLoggingPreference_Values() []string {
+	return []string{
+		CertificateTransparencyLoggingPreferenceEnabled,
+		CertificateTransparencyLoggingPreferenceDisabled,
+	}
+}
+
 const (
 	// CertificateTypeImported is a CertificateType enum value
 	CertificateTypeImported = "IMPORTED"
@@ -4161,6 +4182,15 @@ const (
 	CertificateTypePrivate = "PRIVATE"
 )
 
+// CertificateType_Values returns all elements of the CertificateType enum
+func CertificateType_Values() []string {
+	return []string{
+		CertificateTypeImported,
+		CertificateTypeAmazonIssued,
+		CertificateTypePrivate,
+	}
+}
+
 const (
 	// DomainStatusPendingValidation is a DomainStatus enum value
 	DomainStatusPendingValidation = "PENDING_VALIDATION"
@@ -4172,6 +4202,15 @@ const (
 	DomainStatusFailed = "FAILED"
 )
 
+// DomainStatus_Values returns all elements of the DomainStatus enum
+func DomainStatus_Values() []string {
+	return []string{
+		DomainStatusPendingValidation,
+		DomainStatusSuccess,
+		DomainStatusFailed,
+	}
+}
+
 const (
 	// ExtendedKeyUsageNameTlsWebServerAuthentication is a ExtendedKeyUsageName enum value
 	ExtendedKeyUsageNameTlsWebServerAuthentication = "TLS_WEB_SERVER_AUTHENTICATION"
@@ -4210,6 +4249,24 @@ const (
 	ExtendedKeyUsageNameCustom = "CUSTOM"
 )
 
+// ExtendedKeyUsageName_Values returns all elements of the ExtendedKeyUsageName enum
+func ExtendedKeyUsageName_Values() []string {
+	return []string{
+		ExtendedKeyUsageNameTlsWebServerAuthentication,
+		ExtendedKeyUsageNameTlsWebClientAuthentication,
+		ExtendedKeyUsageNameCodeSigning,
+		ExtendedKeyUsageNameEmailProtection,
+		ExtendedKeyUsageNameTimeStamping,
+		ExtendedKeyUsageNameOcspSigning,
+		ExtendedKeyUsageNameIpsecEndSystem,
+		ExtendedKeyUsageNameIpsecTunnel,
+		ExtendedKeyUsageNameIpsecUser,
+		ExtendedKeyUsageNameAny,
+		ExtendedKeyUsageNameNone,
+		ExtendedKeyUsageNameCustom,
+	}
+}
+
 const (
 	// FailureReasonNoAvailableContacts is a FailureReason enum value
 	FailureReasonNoAvailableContacts = "NO_AVAILABLE_CONTACTS"
@@ -4256,10 +4313,36 @@ const (
 	// FailureReasonPcaAccessDenied is a FailureReason enum value
 	FailureReasonPcaAccessDenied = "PCA_ACCESS_DENIED"
 
+	// FailureReasonSlrNotFound is a FailureReason enum value
+	FailureReasonSlrNotFound = "SLR_NOT_FOUND"
+
 	// FailureReasonOther is a FailureReason enum value
 	FailureReasonOther = "OTHER"
 )
 
+// FailureReason_Values returns all elements of the FailureReason enum
+func FailureReason_Values() []string {
+	return []string{
+		FailureReasonNoAvailableContacts,
+		FailureReasonAdditionalVerificationRequired,
+		FailureReasonDomainNotAllowed,
+		FailureReasonInvalidPublicDomain,
+		FailureReasonDomainValidationDenied,
+		FailureReasonCaaError,
+		FailureReasonPcaLimitExceeded,
+		FailureReasonPcaInvalidArn,
+		FailureReasonPcaInvalidState,
+		FailureReasonPcaRequestFailed,
+		FailureReasonPcaNameConstraintsValidation,
+		FailureReasonPcaResourceNotFound,
+		FailureReasonPcaInvalidArgs,
+		FailureReasonPcaInvalidDuration,
+		FailureReasonPcaAccessDenied,
+		FailureReasonSlrNotFound,
+		FailureReasonOther,
+	}
+}
+
 const (
 	// KeyAlgorithmRsa2048 is a KeyAlgorithm enum value
 	KeyAlgorithmRsa2048 = "RSA_2048"
@@ -4280,6 +4363,18 @@ const (
 	KeyAlgorithmEcSecp521r1 = "EC_secp521r1"
 )
 
+// KeyAlgorithm_Values returns all elements of the KeyAlgorithm enum
+func KeyAlgorithm_Values() []string {
+	return []string{
+		KeyAlgorithmRsa2048,
+		KeyAlgorithmRsa1024,
+		KeyAlgorithmRsa4096,
+		KeyAlgorithmEcPrime256v1,
+		KeyAlgorithmEcSecp384r1,
+		KeyAlgorithmEcSecp521r1,
+	}
+}
+
 const (
 	// KeyUsageNameDigitalSignature is a KeyUsageName enum value
 	KeyUsageNameDigitalSignature = "DIGITAL_SIGNATURE"
@@ -4315,11 +4410,35 @@ const (
 	KeyUsageNameCustom = "CUSTOM"
 )
 
+// KeyUsageName_Values returns all elements of the KeyUsageName enum
+func KeyUsageName_Values() []string {
+	return []string{
+		KeyUsageNameDigitalSignature,
+		KeyUsageNameNonRepudiation,
+		KeyUsageNameKeyEncipherment,
+		KeyUsageNameDataEncipherment,
+		KeyUsageNameKeyAgreement,
+		KeyUsageNameCertificateSigning,
+		KeyUsageNameCrlSigning,
+		KeyUsageNameEncipherOnly,
+		KeyUsageNameDecipherOnly,
+		KeyUsageNameAny,
+		KeyUsageNameCustom,
+	}
+}
+
 const (
 	// RecordTypeCname is a RecordType enum value
 	RecordTypeCname = "CNAME"
 )
 
+// RecordType_Values returns all elements of the RecordType enum
+func RecordType_Values() []string {
+	return []string{
+		RecordTypeCname,
+	}
+}
+
 const (
 	// RenewalEligibilityEligible is a RenewalEligibility enum value
 	RenewalEligibilityEligible = "ELIGIBLE"
@@ -4328,6 +4447,14 @@ const (
 	RenewalEligibilityIneligible = "INELIGIBLE"
 )
 
+// RenewalEligibility_Values returns all elements of the RenewalEligibility enum
+func RenewalEligibility_Values() []string {
+	return []string{
+		RenewalEligibilityEligible,
+		RenewalEligibilityIneligible,
+	}
+}
+
 const (
 	// RenewalStatusPendingAutoRenewal is a RenewalStatus enum value
 	RenewalStatusPendingAutoRenewal = "PENDING_AUTO_RENEWAL"
@@ -4342,6 +4469,16 @@ const (
 	RenewalStatusFailed = "FAILED"
 )
 
+// RenewalStatus_Values returns all elements of the RenewalStatus enum
+func RenewalStatus_Values() []string {
+	return []string{
+		RenewalStatusPendingAutoRenewal,
+		RenewalStatusPendingValidation,
+		RenewalStatusSuccess,
+		RenewalStatusFailed,
+	}
+}
+
 const (
 	// RevocationReasonUnspecified is a RevocationReason enum value
 	RevocationReasonUnspecified = "UNSPECIFIED"
@@ -4374,6 +4511,22 @@ const (
 	RevocationReasonAACompromise = "A_A_COMPROMISE"
 )
 
+// RevocationReason_Values returns all elements of the RevocationReason enum
+func RevocationReason_Values() []string {
+	return []string{
+		RevocationReasonUnspecified,
+		RevocationReasonKeyCompromise,
+		RevocationReasonCaCompromise,
+		RevocationReasonAffiliationChanged,
+		RevocationReasonSuperceded,
+		RevocationReasonCessationOfOperation,
+		RevocationReasonCertificateHold,
+		RevocationReasonRemoveFromCrl,
+		RevocationReasonPrivilegeWithdrawn,
+		RevocationReasonAACompromise,
+	}
+}
+
 const (
 	// ValidationMethodEmail is a ValidationMethod enum value
 	ValidationMethodEmail = "EMAIL"
@@ -4381,3 +4534,11 @@ const (
 	// ValidationMethodDns is a ValidationMethod enum value
 	ValidationMethodDns = "DNS"
 )
+
+// ValidationMethod_Values returns all elements of the ValidationMethod enum
+func ValidationMethod_Values() []string {
+	return []string{
+		ValidationMethodEmail,
+		ValidationMethodDns,
+	}
+}

vendor/github.com/aws/aws-sdk-go/service/cloudtrail/api.go

@@ -255,8 +255,9 @@ func (c *CloudTrail) CreateTrailRequest(input *CreateTrailInput) (req *request.R
 //   valid.
 //
 //   * KmsKeyNotFoundException
-//   This exception is thrown when the KMS key does not exist, or when the S3
-//   bucket and the KMS key are not in the same region.
+//   This exception is thrown when the KMS key does not exist, when the S3 bucket
+//   and the KMS key are not in the same region, or when the KMS key associated
+//   with the SNS topic either does not exist or is not in the same region.
 //
 //   * KmsKeyDisabledException
 //   This exception is no longer in use.
@@ -313,6 +314,11 @@ func (c *CloudTrail) CreateTrailRequest(input *CreateTrailInput) (req *request.R
 //   creating an organization trail. For more information, see Prepare For Creating
 //   a Trail For Your Organization (https://docs.aws.amazon.com/awscloudtrail/latest/userguide/creating-an-organizational-trail-prepare.html).
 //
+//   * CloudTrailInvalidClientTokenIdException
+//   This exception is thrown when a call results in the InvalidClientTokenId
+//   error code. This can occur when you are creating or updating a trail to send
+//   notifications to an Amazon SNS topic that is in a suspended AWS account.
+//
 // See also, https://docs.aws.amazon.com/goto/WebAPI/cloudtrail-2013-11-01/CreateTrail
 func (c *CloudTrail) CreateTrail(input *CreateTrailInput) (*CreateTrailOutput, error) {
 	req, out := c.CreateTrailRequest(input)
@@ -1535,8 +1541,8 @@ func (c *CloudTrail) LookupEventsRequest(input *LookupEventsInput) (req *request
 // with a maximum of 50 possible. The response includes a token that you can
 // use to get the next page of results.
 //
-// The rate of lookup requests is limited to two per second per account. If
-// this limit is exceeded, a throttling error occurs.
+// The rate of lookup requests is limited to two per second, per account, per
+// region. If this limit is exceeded, a throttling error occurs.
 //
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
 // with awserr.Error's Code and Message methods to get detailed information about
@@ -1688,15 +1694,16 @@ func (c *CloudTrail) PutEventSelectorsRequest(input *PutEventSelectorsInput) (re
 
 // PutEventSelectors API operation for AWS CloudTrail.
 //
-// Configures an event selector for your trail. Use event selectors to further
-// specify the management and data event settings for your trail. By default,
-// trails created without specific event selectors will be configured to log
-// all read and write management events, and no data events.
+// Configures an event selector or advanced event selectors for your trail.
+// Use event selectors or advanced event selectors to specify management and
+// data event settings for your trail. By default, trails created without specific
+// event selectors are configured to log all read and write management events,
+// and no data events.
 //
 // When an event occurs in your account, CloudTrail evaluates the event selectors
-// in all trails. For each trail, if the event matches any event selector, the
-// trail processes and logs the event. If the event doesn't match any event
-// selector, the trail doesn't log the event.
+// or advanced event selectors in all trails. For each trail, if the event matches
+// any event selector, the trail processes and logs the event. If the event
+// doesn't match any event selector, the trail doesn't log the event.
 //
 // Example
 //
@@ -1710,15 +1717,24 @@ func (c *CloudTrail) PutEventSelectorsRequest(input *PutEventSelectorsInput) (re
 // The RunInstances is a write-only event and it matches your event selector.
 // The trail logs the event.
 //
-// The GetConsoleOutput is a read-only event but it doesn't match your event
-// selector. The trail doesn't log the event.
+// The GetConsoleOutput is a read-only event that doesn't match your event selector.
+// The trail doesn't log the event.
 //
 // The PutEventSelectors operation must be called from the region in which the
-// trail was created; otherwise, an InvalidHomeRegionException is thrown.
+// trail was created; otherwise, an InvalidHomeRegionException exception is
+// thrown.
 //
 // You can configure up to five event selectors for each trail. For more information,
-// see Logging Data and Management Events for Trails (https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-management-and-data-events-with-cloudtrail.html)
-// and Limits in AWS CloudTrail (https://docs.aws.amazon.com/awscloudtrail/latest/userguide/WhatIsCloudTrail-Limits.html)
+// see Logging data and management events for trails (https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-management-and-data-events-with-cloudtrail.html)
+// and Quotas in AWS CloudTrail (https://docs.aws.amazon.com/awscloudtrail/latest/userguide/WhatIsCloudTrail-Limits.html)
+// in the AWS CloudTrail User Guide.
+//
+// You can add advanced event selectors, and conditions for your advanced event
+// selectors, up to a maximum of 500 values for all conditions and selectors
+// on a trail. You can use either AdvancedEventSelectors or EventSelectors,
+// but not both. If you apply AdvancedEventSelectors to a trail, any existing
+// EventSelectors are overwritten. For more information about advanced event
+// selectors, see Logging data events for trails (https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html)
 // in the AWS CloudTrail User Guide.
 //
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
@@ -1754,11 +1770,13 @@ func (c *CloudTrail) PutEventSelectorsRequest(input *PutEventSelectorsInput) (re
 //
 //   * InvalidEventSelectorsException
 //   This exception is thrown when the PutEventSelectors operation is called with
-//   a number of event selectors or data resources that is not valid. The combination
-//   of event selectors and data resources is not valid. A trail can have up to
-//   5 event selectors. A trail is limited to 250 data resources. These data resources
-//   can be distributed across event selectors, but the overall total cannot exceed
-//   250.
+//   a number of event selectors, advanced event selectors, or data resources
+//   that is not valid. The combination of event selectors or advanced event selectors
+//   and data resources is not valid. A trail can have up to 5 event selectors.
+//   If a trail uses advanced event selectors, a maximum of 500 total values for
+//   all conditions in all advanced event selectors is allowed. A trail is limited
+//   to 250 data resources. These data resources can be distributed across event
+//   selectors, but the overall total cannot exceed 250.
 //
 //   You can:
 //
@@ -1770,6 +1788,9 @@ func (c *CloudTrail) PutEventSelectorsRequest(input *PutEventSelectorsInput) (re
 //      of data resources does not exceed 250 across all event selectors for a
 //      trail.
 //
+//      * Specify up to 500 values for all conditions in all advanced event selectors
+//      for a trail.
+//
 //      * Specify a valid value for a parameter. For example, specifying the ReadWriteType
 //      parameter with a value of read-only is invalid.
 //
@@ -2415,11 +2436,13 @@ func (c *CloudTrail) UpdateTrailRequest(input *UpdateTrailInput) (req *request.R
 //
 //   * InvalidEventSelectorsException
 //   This exception is thrown when the PutEventSelectors operation is called with
-//   a number of event selectors or data resources that is not valid. The combination
-//   of event selectors and data resources is not valid. A trail can have up to
-//   5 event selectors. A trail is limited to 250 data resources. These data resources
-//   can be distributed across event selectors, but the overall total cannot exceed
-//   250.
+//   a number of event selectors, advanced event selectors, or data resources
+//   that is not valid. The combination of event selectors or advanced event selectors
+//   and data resources is not valid. A trail can have up to 5 event selectors.
+//   If a trail uses advanced event selectors, a maximum of 500 total values for
+//   all conditions in all advanced event selectors is allowed. A trail is limited
+//   to 250 data resources. These data resources can be distributed across event
+//   selectors, but the overall total cannot exceed 250.
 //
 //   You can:
 //
@@ -2431,6 +2454,9 @@ func (c *CloudTrail) UpdateTrailRequest(input *UpdateTrailInput) (req *request.R
 //      of data resources does not exceed 250 across all event selectors for a
 //      trail.
 //
+//      * Specify up to 500 values for all conditions in all advanced event selectors
+//      for a trail.
+//
 //      * Specify a valid value for a parameter. For example, specifying the ReadWriteType
 //      parameter with a value of read-only is invalid.
 //
@@ -2443,8 +2469,9 @@ func (c *CloudTrail) UpdateTrailRequest(input *UpdateTrailInput) (req *request.R
 //   other than the region in which the trail was created.
 //
 //   * KmsKeyNotFoundException
-//   This exception is thrown when the KMS key does not exist, or when the S3
-//   bucket and the KMS key are not in the same region.
+//   This exception is thrown when the KMS key does not exist, when the S3 bucket
+//   and the KMS key are not in the same region, or when the KMS key associated
+//   with the SNS topic either does not exist or is not in the same region.
 //
 //   * KmsKeyDisabledException
 //   This exception is no longer in use.
@@ -2497,6 +2524,11 @@ func (c *CloudTrail) UpdateTrailRequest(input *UpdateTrailInput) (req *request.R
 //   creating an organization trail. For more information, see Prepare For Creating
 //   a Trail For Your Organization (https://docs.aws.amazon.com/awscloudtrail/latest/userguide/creating-an-organizational-trail-prepare.html).
 //
+//   * CloudTrailInvalidClientTokenIdException
+//   This exception is thrown when a call results in the InvalidClientTokenId
+//   error code. This can occur when you are creating or updating a trail to send
+//   notifications to an Amazon SNS topic that is in a suspended AWS account.
+//
 // See also, https://docs.aws.amazon.com/goto/WebAPI/cloudtrail-2013-11-01/UpdateTrail
 func (c *CloudTrail) UpdateTrail(input *UpdateTrailInput) (*UpdateTrailOutput, error) {
 	req, out := c.UpdateTrailRequest(input)
@@ -2714,6 +2746,295 @@ func (s AddTagsOutput) GoString() string {
 	return s.String()
 }
 
+// Advanced event selectors let you create fine-grained selectors for the following
+// AWS CloudTrail event record fields. They help you control costs by logging
+// only those events that are important to you. For more information about advanced
+// event selectors, see Logging data events for trails (https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html)
+// in the AWS CloudTrail User Guide.
+//
+//    * readOnly
+//
+//    * eventSource
+//
+//    * eventName
+//
+//    * eventCategory
+//
+//    * resources.type
+//
+//    * resources.ARN
+//
+// You cannot apply both event selectors and advanced event selectors to a trail.
+type AdvancedEventSelector struct {
+	_ struct{} `type:"structure"`
+
+	// Contains all selector statements in an advanced event selector.
+	//
+	// FieldSelectors is a required field
+	FieldSelectors []*AdvancedFieldSelector `min:"1" type:"list" required:"true"`
+
+	// An optional, descriptive name for an advanced event selector, such as "Log
+	// data events for only two S3 buckets".
+	Name *string `type:"string"`
+}
+
+// String returns the string representation
+func (s AdvancedEventSelector) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s AdvancedEventSelector) GoString() string {
+	return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *AdvancedEventSelector) Validate() error {
+	invalidParams := request.ErrInvalidParams{Context: "AdvancedEventSelector"}
+	if s.FieldSelectors == nil {
+		invalidParams.Add(request.NewErrParamRequired("FieldSelectors"))
+	}
+	if s.FieldSelectors != nil && len(s.FieldSelectors) < 1 {
+		invalidParams.Add(request.NewErrParamMinLen("FieldSelectors", 1))
+	}
+	if s.FieldSelectors != nil {
+		for i, v := range s.FieldSelectors {
+			if v == nil {
+				continue
+			}
+			if err := v.Validate(); err != nil {
+				invalidParams.AddNested(fmt.Sprintf("%s[%v]", "FieldSelectors", i), err.(request.ErrInvalidParams))
+			}
+		}
+	}
+
+	if invalidParams.Len() > 0 {
+		return invalidParams
+	}
+	return nil
+}
+
+// SetFieldSelectors sets the FieldSelectors field's value.
+func (s *AdvancedEventSelector) SetFieldSelectors(v []*AdvancedFieldSelector) *AdvancedEventSelector {
+	s.FieldSelectors = v
+	return s
+}
+
+// SetName sets the Name field's value.
+func (s *AdvancedEventSelector) SetName(v string) *AdvancedEventSelector {
+	s.Name = &v
+	return s
+}
+
+// A single selector statement in an advanced event selector.
+type AdvancedFieldSelector struct {
+	_ struct{} `type:"structure"`
+
+	// An operator that includes events that match the last few characters of the
+	// event record field specified as the value of Field.
+	EndsWith []*string `min:"1" type:"list"`
+
+	// An operator that includes events that match the exact value of the event
+	// record field specified as the value of Field. This is the only valid operator
+	// that you can use with the readOnly, eventCategory, and resources.type fields.
+	Equals []*string `min:"1" type:"list"`
+
+	// A field in an event record on which to filter events to be logged. Supported
+	// fields include readOnly, eventCategory, eventSource (for management events),
+	// eventName, resources.type, and resources.ARN.
+	//
+	//    * readOnly - Optional. Can be set to Equals a value of true or false.
+	//    A value of false logs both read and write events.
+	//
+	//    * eventSource - For filtering management events only. This can be set
+	//    only to NotEquals kms.amazonaws.com.
+	//
+	//    * eventName - Can use any operator. You can use it to filter in or filter
+	//    out any data event logged to CloudTrail, such as PutBucket. You can have
+	//    multiple values for this field, separated by commas.
+	//
+	//    * eventCategory - This is required. It must be set to Equals, and the
+	//    value must be Management or Data.
+	//
+	//    * resources.type - This field is required. resources.type can only use
+	//    the Equals operator, and the value can be one of the following: AWS::S3::Object
+	//    or AWS::Lambda::Function. You can have only one resources.type field
+	//    per selector. To log data events on more than one resource type, add another
+	//    selector.
+	//
+	//    * resources.ARN - You can use any operator with resources.ARN, but if
+	//    you use Equals or NotEquals, the value must exactly match the ARN of a
+	//    valid resource of the type you've specified in the template as the value
+	//    of resources.type. For example, if resources.type equals AWS::S3::Object,
+	//    the ARN must be in one of the following formats. The trailing slash is
+	//    intentional; do not exclude it. arn:partition:s3:::bucket_name/ arn:partition:s3:::bucket_name/object_or_file_name/
+	//    When resources.type equals AWS::Lambda::Function, and the operator is
+	//    set to Equals or NotEquals, the ARN must be in the following format: arn:partition:lambda:region:account_ID:function:function_name
+	//
+	// Field is a required field
+	Field *string `min:"1" type:"string" required:"true"`
+
+	// An operator that excludes events that match the last few characters of the
+	// event record field specified as the value of Field.
+	NotEndsWith []*string `min:"1" type:"list"`
+
+	// An operator that excludes events that match the exact value of the event
+	// record field specified as the value of Field.
+	NotEquals []*string `min:"1" type:"list"`
+
+	// An operator that excludes events that match the first few characters of the
+	// event record field specified as the value of Field.
+	NotStartsWith []*string `min:"1" type:"list"`
+
+	// An operator that includes events that match the first few characters of the
+	// event record field specified as the value of Field.
+	StartsWith []*string `min:"1" type:"list"`
+}
+
+// String returns the string representation
+func (s AdvancedFieldSelector) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s AdvancedFieldSelector) GoString() string {
+	return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *AdvancedFieldSelector) Validate() error {
+	invalidParams := request.ErrInvalidParams{Context: "AdvancedFieldSelector"}
+	if s.EndsWith != nil && len(s.EndsWith) < 1 {
+		invalidParams.Add(request.NewErrParamMinLen("EndsWith", 1))
+	}
+	if s.Equals != nil && len(s.Equals) < 1 {
+		invalidParams.Add(request.NewErrParamMinLen("Equals", 1))
+	}
+	if s.Field == nil {
+		invalidParams.Add(request.NewErrParamRequired("Field"))
+	}
+	if s.Field != nil && len(*s.Field) < 1 {
+		invalidParams.Add(request.NewErrParamMinLen("Field", 1))
+	}
+	if s.NotEndsWith != nil && len(s.NotEndsWith) < 1 {
+		invalidParams.Add(request.NewErrParamMinLen("NotEndsWith", 1))
+	}
+	if s.NotEquals != nil && len(s.NotEquals) < 1 {
+		invalidParams.Add(request.NewErrParamMinLen("NotEquals", 1))
+	}
+	if s.NotStartsWith != nil && len(s.NotStartsWith) < 1 {
+		invalidParams.Add(request.NewErrParamMinLen("NotStartsWith", 1))
+	}
+	if s.StartsWith != nil && len(s.StartsWith) < 1 {
+		invalidParams.Add(request.NewErrParamMinLen("StartsWith", 1))
+	}
+
+	if invalidParams.Len() > 0 {
+		return invalidParams
+	}
+	return nil
+}
+
+// SetEndsWith sets the EndsWith field's value.
+func (s *AdvancedFieldSelector) SetEndsWith(v []*string) *AdvancedFieldSelector {
+	s.EndsWith = v
+	return s
+}
+
+// SetEquals sets the Equals field's value.
+func (s *AdvancedFieldSelector) SetEquals(v []*string) *AdvancedFieldSelector {
+	s.Equals = v
+	return s
+}
+
+// SetField sets the Field field's value.
+func (s *AdvancedFieldSelector) SetField(v string) *AdvancedFieldSelector {
+	s.Field = &v
+	return s
+}
+
+// SetNotEndsWith sets the NotEndsWith field's value.
+func (s *AdvancedFieldSelector) SetNotEndsWith(v []*string) *AdvancedFieldSelector {
+	s.NotEndsWith = v
+	return s
+}
+
+// SetNotEquals sets the NotEquals field's value.
+func (s *AdvancedFieldSelector) SetNotEquals(v []*string) *AdvancedFieldSelector {
+	s.NotEquals = v
+	return s
+}
+
+// SetNotStartsWith sets the NotStartsWith field's value.
+func (s *AdvancedFieldSelector) SetNotStartsWith(v []*string) *AdvancedFieldSelector {
+	s.NotStartsWith = v
+	return s
+}
+
+// SetStartsWith sets the StartsWith field's value.
+func (s *AdvancedFieldSelector) SetStartsWith(v []*string) *AdvancedFieldSelector {
+	s.StartsWith = v
+	return s
+}
+
+// This exception is thrown when a call results in the InvalidClientTokenId
+// error code. This can occur when you are creating or updating a trail to send
+// notifications to an Amazon SNS topic that is in a suspended AWS account.
+type CloudTrailInvalidClientTokenIdException struct {
+	_            struct{}                  `type:"structure"`
+	RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"`
+
+	Message_ *string `locationName:"message" type:"string"`
+}
+
+// String returns the string representation
+func (s CloudTrailInvalidClientTokenIdException) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s CloudTrailInvalidClientTokenIdException) GoString() string {
+	return s.String()
+}
+
+func newErrorCloudTrailInvalidClientTokenIdException(v protocol.ResponseMetadata) error {
+	return &CloudTrailInvalidClientTokenIdException{
+		RespMetadata: v,
+	}
+}
+
+// Code returns the exception type name.
+func (s *CloudTrailInvalidClientTokenIdException) Code() string {
+	return "CloudTrailInvalidClientTokenIdException"
+}
+
+// Message returns the exception's message.
+func (s *CloudTrailInvalidClientTokenIdException) Message() string {
+	if s.Message_ != nil {
+		return *s.Message_
+	}
+	return ""
+}
+
+// OrigErr always returns nil, satisfies awserr.Error interface.
+func (s *CloudTrailInvalidClientTokenIdException) OrigErr() error {
+	return nil
+}
+
+func (s *CloudTrailInvalidClientTokenIdException) Error() string {
+	return fmt.Sprintf("%s: %s", s.Code(), s.Message())
+}
+
+// Status code returns the HTTP status code for the request's response error.
+func (s *CloudTrailInvalidClientTokenIdException) StatusCode() int {
+	return s.RespMetadata.StatusCode
+}
+
+// RequestID returns the service's response RequestID for request.
+func (s *CloudTrailInvalidClientTokenIdException) RequestID() string {
+	return s.RespMetadata.RequestID
+}
+
 // Cannot set a CloudWatch Logs delivery for this region.
 type CloudWatchLogsDeliveryUnavailableException struct {
 	_            struct{}                  `type:"structure"`
@@ -3132,6 +3453,10 @@ func (s *CreateTrailOutput) SetTrailARN(v string) *CreateTrailOutput {
 // between 1 and 5 event selectors, but the total cannot exceed 250 across all
 // selectors.
 //
+// If you are using advanced event selectors, the maximum total number of values
+// for all conditions, across all advanced event selectors for the trail, is
+// 500.
+//
 // The following example demonstrates how logging works when you configure logging
 // of all data events for an S3 bucket named bucket-1. In this example, the
 // CloudTrail user specified an empty prefix, and the option to log both Read
@@ -3475,6 +3800,8 @@ func (s *Event) SetUsername(v string) *Event {
 // selector, the trail doesn't log the event.
 //
 // You can configure up to five event selectors for a trail.
+//
+// You cannot apply both event selectors and advanced event selectors to a trail.
 type EventSelector struct {
 	_ struct{} `type:"structure"`
 
@@ -3504,6 +3831,11 @@ type EventSelector struct {
 	// in the AWS CloudTrail User Guide.
 	//
 	// By default, the value is true.
+	//
+	// The first copy of management events is free. You are charged for additional
+	// copies of management events that you are logging on any subsequent trail
+	// in the same region. For more information about CloudTrail pricing, see AWS
+	// CloudTrail Pricing (http://aws.amazon.com/cloudtrail/pricing/).
 	IncludeManagementEvents *bool `type:"boolean"`
 
 	// Specify if you want your trail to log read-only events, write-only events,
@@ -3606,6 +3938,9 @@ func (s *GetEventSelectorsInput) SetTrailName(v string) *GetEventSelectorsInput
 type GetEventSelectorsOutput struct {
 	_ struct{} `type:"structure"`
 
+	// The advanced event selectors that are configured for the trail.
+	AdvancedEventSelectors []*AdvancedEventSelector `type:"list"`
+
 	// The event selectors that are configured for the trail.
 	EventSelectors []*EventSelector `type:"list"`
 
@@ -3623,6 +3958,12 @@ func (s GetEventSelectorsOutput) GoString() string {
 	return s.String()
 }
 
+// SetAdvancedEventSelectors sets the AdvancedEventSelectors field's value.
+func (s *GetEventSelectorsOutput) SetAdvancedEventSelectors(v []*AdvancedEventSelector) *GetEventSelectorsOutput {
+	s.AdvancedEventSelectors = v
+	return s
+}
+
 // SetEventSelectors sets the EventSelectors field's value.
 func (s *GetEventSelectorsOutput) SetEventSelectors(v []*EventSelector) *GetEventSelectorsOutput {
 	s.EventSelectors = v
@@ -4504,11 +4845,13 @@ func (s *InvalidEventCategoryException) RequestID() string {
 }
 
 // This exception is thrown when the PutEventSelectors operation is called with
-// a number of event selectors or data resources that is not valid. The combination
-// of event selectors and data resources is not valid. A trail can have up to
-// 5 event selectors. A trail is limited to 250 data resources. These data resources
-// can be distributed across event selectors, but the overall total cannot exceed
-// 250.
+// a number of event selectors, advanced event selectors, or data resources
+// that is not valid. The combination of event selectors or advanced event selectors
+// and data resources is not valid. A trail can have up to 5 event selectors.
+// If a trail uses advanced event selectors, a maximum of 500 total values for
+// all conditions in all advanced event selectors is allowed. A trail is limited
+// to 250 data resources. These data resources can be distributed across event
+// selectors, but the overall total cannot exceed 250.
 //
 // You can:
 //
@@ -4520,6 +4863,9 @@ func (s *InvalidEventCategoryException) RequestID() string {
 //    of data resources does not exceed 250 across all event selectors for a
 //    trail.
 //
+//    * Specify up to 500 values for all conditions in all advanced event selectors
+//    for a trail.
+//
 //    * Specify a valid value for a parameter. For example, specifying the ReadWriteType
 //    parameter with a value of read-only is invalid.
 type InvalidEventSelectorsException struct {
@@ -5496,8 +5842,9 @@ func (s *KmsKeyDisabledException) RequestID() string {
 	return s.RespMetadata.RequestID
 }
 
-// This exception is thrown when the KMS key does not exist, or when the S3
-// bucket and the KMS key are not in the same region.
+// This exception is thrown when the KMS key does not exist, when the S3 bucket
+// and the KMS key are not in the same region, or when the KMS key associated
+// with the SNS topic either does not exist or is not in the same region.
 type KmsKeyNotFoundException struct {
 	_            struct{}                  `type:"structure"`
 	RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"`
@@ -6323,11 +6670,21 @@ func (s *PublicKey) SetValue(v []byte) *PublicKey {
 type PutEventSelectorsInput struct {
 	_ struct{} `type:"structure"`
 
+	// Specifies the settings for advanced event selectors. You can add advanced
+	// event selectors, and conditions for your advanced event selectors, up to
+	// a maximum of 500 values for all conditions and selectors on a trail. You
+	// can use either AdvancedEventSelectors or EventSelectors, but not both. If
+	// you apply AdvancedEventSelectors to a trail, any existing EventSelectors
+	// are overwritten. For more information about advanced event selectors, see
+	// Logging data events for trails (https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html)
+	// in the AWS CloudTrail User Guide.
+	AdvancedEventSelectors []*AdvancedEventSelector `type:"list"`
+
 	// Specifies the settings for your event selectors. You can configure up to
-	// five event selectors for a trail.
-	//
-	// EventSelectors is a required field
-	EventSelectors []*EventSelector `type:"list" required:"true"`
+	// five event selectors for a trail. You can use either EventSelectors or AdvancedEventSelectors
+	// in a PutEventSelectors request, but not both. If you apply EventSelectors
+	// to a trail, any existing AdvancedEventSelectors are overwritten.
+	EventSelectors []*EventSelector `type:"list"`
 
 	// Specifies the name of the trail or trail ARN. If you specify a trail name,
 	// the string must meet the following requirements:
@@ -6365,12 +6722,19 @@ func (s PutEventSelectorsInput) GoString() string {
 // Validate inspects the fields of the type to determine if they are valid.
 func (s *PutEventSelectorsInput) Validate() error {
 	invalidParams := request.ErrInvalidParams{Context: "PutEventSelectorsInput"}
-	if s.EventSelectors == nil {
-		invalidParams.Add(request.NewErrParamRequired("EventSelectors"))
-	}
 	if s.TrailName == nil {
 		invalidParams.Add(request.NewErrParamRequired("TrailName"))
 	}
+	if s.AdvancedEventSelectors != nil {
+		for i, v := range s.AdvancedEventSelectors {
+			if v == nil {
+				continue
+			}
+			if err := v.Validate(); err != nil {
+				invalidParams.AddNested(fmt.Sprintf("%s[%v]", "AdvancedEventSelectors", i), err.(request.ErrInvalidParams))
+			}
+		}
+	}
 
 	if invalidParams.Len() > 0 {
 		return invalidParams
@@ -6378,6 +6742,12 @@ func (s *PutEventSelectorsInput) Validate() error {
 	return nil
 }
 
+// SetAdvancedEventSelectors sets the AdvancedEventSelectors field's value.
+func (s *PutEventSelectorsInput) SetAdvancedEventSelectors(v []*AdvancedEventSelector) *PutEventSelectorsInput {
+	s.AdvancedEventSelectors = v
+	return s
+}
+
 // SetEventSelectors sets the EventSelectors field's value.
 func (s *PutEventSelectorsInput) SetEventSelectors(v []*EventSelector) *PutEventSelectorsInput {
 	s.EventSelectors = v
@@ -6393,6 +6763,9 @@ func (s *PutEventSelectorsInput) SetTrailName(v string) *PutEventSelectorsInput
 type PutEventSelectorsOutput struct {
 	_ struct{} `type:"structure"`
 
+	// Specifies the advanced event selectors configured for your trail.
+	AdvancedEventSelectors []*AdvancedEventSelector `type:"list"`
+
 	// Specifies the event selectors configured for your trail.
 	EventSelectors []*EventSelector `type:"list"`
 
@@ -6413,6 +6786,12 @@ func (s PutEventSelectorsOutput) GoString() string {
 	return s.String()
 }
 
+// SetAdvancedEventSelectors sets the AdvancedEventSelectors field's value.
+func (s *PutEventSelectorsOutput) SetAdvancedEventSelectors(v []*AdvancedEventSelector) *PutEventSelectorsOutput {
+	s.AdvancedEventSelectors = v
+	return s
+}
+
 // SetEventSelectors sets the EventSelectors field's value.
 func (s *PutEventSelectorsOutput) SetEventSelectors(v []*EventSelector) *PutEventSelectorsOutput {
 	s.EventSelectors = v
@@ -7845,11 +8224,25 @@ const (
 	EventCategoryInsight = "insight"
 )
 
+// EventCategory_Values returns all elements of the EventCategory enum
+func EventCategory_Values() []string {
+	return []string{
+		EventCategoryInsight,
+	}
+}
+
 const (
 	// InsightTypeApiCallRateInsight is a InsightType enum value
 	InsightTypeApiCallRateInsight = "ApiCallRateInsight"
 )
 
+// InsightType_Values returns all elements of the InsightType enum
+func InsightType_Values() []string {
+	return []string{
+		InsightTypeApiCallRateInsight,
+	}
+}
+
 const (
 	// LookupAttributeKeyEventId is a LookupAttributeKey enum value
 	LookupAttributeKeyEventId = "EventId"
@@ -7876,6 +8269,20 @@ const (
 	LookupAttributeKeyAccessKeyId = "AccessKeyId"
 )
 
+// LookupAttributeKey_Values returns all elements of the LookupAttributeKey enum
+func LookupAttributeKey_Values() []string {
+	return []string{
+		LookupAttributeKeyEventId,
+		LookupAttributeKeyEventName,
+		LookupAttributeKeyReadOnly,
+		LookupAttributeKeyUsername,
+		LookupAttributeKeyResourceType,
+		LookupAttributeKeyResourceName,
+		LookupAttributeKeyEventSource,
+		LookupAttributeKeyAccessKeyId,
+	}
+}
+
 const (
 	// ReadWriteTypeReadOnly is a ReadWriteType enum value
 	ReadWriteTypeReadOnly = "ReadOnly"
@@ -7886,3 +8293,12 @@ const (
 	// ReadWriteTypeAll is a ReadWriteType enum value
 	ReadWriteTypeAll = "All"
 )
+
+// ReadWriteType_Values returns all elements of the ReadWriteType enum
+func ReadWriteType_Values() []string {
+	return []string{
+		ReadWriteTypeReadOnly,
+		ReadWriteTypeWriteOnly,
+		ReadWriteTypeAll,
+	}
+}

vendor/github.com/aws/aws-sdk-go/service/cloudtrail/errors.go

@@ -26,6 +26,14 @@ const (
 	// and Prepare For Creating a Trail For Your Organization (https://docs.aws.amazon.com/awscloudtrail/latest/userguide/creating-an-organizational-trail-prepare.html).
 	ErrCodeAccessNotEnabledException = "CloudTrailAccessNotEnabledException"
 
+	// ErrCodeCloudTrailInvalidClientTokenIdException for service response error code
+	// "CloudTrailInvalidClientTokenIdException".
+	//
+	// This exception is thrown when a call results in the InvalidClientTokenId
+	// error code. This can occur when you are creating or updating a trail to send
+	// notifications to an Amazon SNS topic that is in a suspended AWS account.
+	ErrCodeCloudTrailInvalidClientTokenIdException = "CloudTrailInvalidClientTokenIdException"
+
 	// ErrCodeCloudWatchLogsDeliveryUnavailableException for service response error code
 	// "CloudWatchLogsDeliveryUnavailableException".
 	//
@@ -90,11 +98,13 @@ const (
 	// "InvalidEventSelectorsException".
 	//
 	// This exception is thrown when the PutEventSelectors operation is called with
-	// a number of event selectors or data resources that is not valid. The combination
-	// of event selectors and data resources is not valid. A trail can have up to
-	// 5 event selectors. A trail is limited to 250 data resources. These data resources
-	// can be distributed across event selectors, but the overall total cannot exceed
-	// 250.
+	// a number of event selectors, advanced event selectors, or data resources
+	// that is not valid. The combination of event selectors or advanced event selectors
+	// and data resources is not valid. A trail can have up to 5 event selectors.
+	// If a trail uses advanced event selectors, a maximum of 500 total values for
+	// all conditions in all advanced event selectors is allowed. A trail is limited
+	// to 250 data resources. These data resources can be distributed across event
+	// selectors, but the overall total cannot exceed 250.
 	//
 	// You can:
 	//
@@ -106,6 +116,9 @@ const (
 	//    of data resources does not exceed 250 across all event selectors for a
 	//    trail.
 	//
+	//    * Specify up to 500 values for all conditions in all advanced event selectors
+	//    for a trail.
+	//
 	//    * Specify a valid value for a parameter. For example, specifying the ReadWriteType
 	//    parameter with a value of read-only is invalid.
 	ErrCodeInvalidEventSelectorsException = "InvalidEventSelectorsException"
@@ -230,8 +243,9 @@ const (
 	// ErrCodeKmsKeyNotFoundException for service response error code
 	// "KmsKeyNotFoundException".
 	//
-	// This exception is thrown when the KMS key does not exist, or when the S3
-	// bucket and the KMS key are not in the same region.
+	// This exception is thrown when the KMS key does not exist, when the S3 bucket
+	// and the KMS key are not in the same region, or when the KMS key associated
+	// with the SNS topic either does not exist or is not in the same region.
 	ErrCodeKmsKeyNotFoundException = "KmsKeyNotFoundException"
 
 	// ErrCodeMaximumNumberOfTrailsExceededException for service response error code
@@ -326,6 +340,7 @@ const (
 var exceptionFromCode = map[string]func(protocol.ResponseMetadata) error{
 	"CloudTrailARNInvalidException":                          newErrorARNInvalidException,
 	"CloudTrailAccessNotEnabledException":                    newErrorAccessNotEnabledException,
+	"CloudTrailInvalidClientTokenIdException":                newErrorCloudTrailInvalidClientTokenIdException,
 	"CloudWatchLogsDeliveryUnavailableException":             newErrorCloudWatchLogsDeliveryUnavailableException,
 	"InsightNotEnabledException":                             newErrorInsightNotEnabledException,
 	"InsufficientDependencyServiceAccessPermissionException": newErrorInsufficientDependencyServiceAccessPermissionException,

vendor/github.com/aws/aws-sdk-go/service/cloudwatch/api.go

@@ -246,7 +246,7 @@ func (c *CloudWatch) DeleteDashboardsRequest(input *DeleteDashboardsInput) (req
 
 // DeleteDashboards API operation for Amazon CloudWatch.
 //
-// Deletes all dashboards that you specify. You may specify up to 100 dashboards
+// Deletes all dashboards that you specify. You can specify up to 100 dashboards
 // to delete. If there is an error during this call, no dashboards are deleted.
 //
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
@@ -335,8 +335,7 @@ func (c *CloudWatch) DeleteInsightRulesRequest(input *DeleteInsightRulesInput) (
 // Permanently deletes the specified Contributor Insights rules.
 //
 // If you create a rule, delete it, and then re-create it with the same name,
-// historical data from the first time the rule was created may or may not be
-// available.
+// historical data from the first time the rule was created might not be available.
 //
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
 // with awserr.Error's Code and Message methods to get detailed information about
@@ -566,7 +565,7 @@ func (c *CloudWatch) DescribeAlarmsRequest(input *DescribeAlarmsInput) (req *req
 // DescribeAlarms API operation for Amazon CloudWatch.
 //
 // Retrieves the specified alarms. You can filter the results by specifying
-// a a prefix for the alarm name, the alarm state, or a prefix for any action.
+// a prefix for the alarm name, the alarm state, or a prefix for any action.
 //
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
 // with awserr.Error's Code and Message methods to get detailed information about
@@ -700,6 +699,10 @@ func (c *CloudWatch) DescribeAlarmsForMetricRequest(input *DescribeAlarmsForMetr
 // Retrieves the alarms for the specified metric. To filter the results, specify
 // a statistic, period, or unit.
 //
+// This operation retrieves only standard alarms that are based on the specified
+// metric. It does not return alarms based on math expressions that use the
+// specified metric, or composite alarms that use the specified metric.
+//
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
 // with awserr.Error's Code and Message methods to get detailed information about
 // the error.
@@ -865,8 +868,7 @@ func (c *CloudWatch) DescribeInsightRulesRequest(input *DescribeInsightRulesInpu
 
 // DescribeInsightRules API operation for Amazon CloudWatch.
 //
-// Returns a list of all the Contributor Insights rules in your account. All
-// rules in your account are returned with a single operation.
+// Returns a list of all the Contributor Insights rules in your account.
 //
 // For more information about Contributor Insights, see Using Contributor Insights
 // to Analyze High-Cardinality Data (https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/ContributorInsights.html).
@@ -1420,7 +1422,7 @@ func (c *CloudWatch) GetInsightRuleReportRequest(input *GetInsightRuleReportInpu
 //    point.
 //
 //    * MaxContributorValue -- the value of the top contributor for each data
-//    point. The identity of the contributor may change for each data point
+//    point. The identity of the contributor might change for each data point
 //    in the graph. If this rule aggregates by COUNT, the top contributor for
 //    each data point is the contributor with the most occurrences in that period.
 //    If the rule aggregates by SUM, the top contributor is the contributor
@@ -1569,9 +1571,9 @@ func (c *CloudWatch) GetMetricDataRequest(input *GetMetricDataInput) (req *reque
 // If you omit Unit in your request, all data that was collected with any unit
 // is returned, along with the corresponding units that were specified when
 // the data was reported to CloudWatch. If you specify a unit, the operation
-// returns only data data that was collected with that unit specified. If you
-// specify a unit that does not match the data collected, the results of the
-// operation are null. CloudWatch does not perform unit conversions.
+// returns only data that was collected with that unit specified. If you specify
+// a unit that does not match the data collected, the results of the operation
+// are null. CloudWatch does not perform unit conversions.
 //
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
 // with awserr.Error's Code and Message methods to get detailed information about
@@ -2091,9 +2093,13 @@ func (c *CloudWatch) ListMetricsRequest(input *ListMetricsInput) (req *request.R
 // Up to 500 results are returned for any one call. To retrieve additional results,
 // use the returned token with subsequent calls.
 //
-// After you create a metric, allow up to fifteen minutes before the metric
-// appears. Statistics about the metric, however, are available sooner using
-// GetMetricData (https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_GetMetricData.html)
+// After you create a metric, allow up to 15 minutes before the metric appears.
+// You can see statistics about the metric sooner by using GetMetricData (https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_GetMetricData.html)
+// or GetMetricStatistics (https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_GetMetricStatistics.html).
+//
+// ListMetrics doesn't return information about metrics if those metrics haven't
+// reported data in the past two weeks. To retrieve those metrics, use GetMetricData
+// (https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_GetMetricData.html)
 // or GetMetricStatistics (https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_GetMetricStatistics.html).
 //
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
@@ -2447,6 +2453,9 @@ func (c *CloudWatch) PutCompositeAlarmRequest(input *PutCompositeAlarmInput) (re
 // When you update an existing alarm, its state is left unchanged, but the update
 // completely overwrites the previous configuration of the alarm.
 //
+// If you are an IAM user, you must have iam:CreateServiceLinkedRole to create
+// a composite alarm that has Systems Manager OpsItem actions.
+//
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
 // with awserr.Error's Code and Message methods to get detailed information about
 // the error.
@@ -2630,8 +2639,7 @@ func (c *CloudWatch) PutInsightRuleRequest(input *PutInsightRuleInput) (req *req
 // Analyze High-Cardinality Data (https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/ContributorInsights.html).
 //
 // If you create a rule, delete it, and then re-create it with the same name,
-// historical data from the first time the rule was created may or may not be
-// available.
+// historical data from the first time the rule was created might not be available.
 //
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
 // with awserr.Error's Code and Message methods to get detailed information about
@@ -2732,34 +2740,16 @@ func (c *CloudWatch) PutMetricAlarmRequest(input *PutMetricAlarmInput) (req *req
 // If you are an IAM user, you must have Amazon EC2 permissions for some alarm
 // operations:
 //
-//    * iam:CreateServiceLinkedRole for all alarms with EC2 actions
+//    * The iam:CreateServiceLinkedRole for all alarms with EC2 actions
 //
-//    * ec2:DescribeInstanceStatus and ec2:DescribeInstances for all alarms
-//    on EC2 instance status metrics
-//
-//    * ec2:StopInstances for alarms with stop actions
-//
-//    * ec2:TerminateInstances for alarms with terminate actions
-//
-//    * No specific permissions are needed for alarms with recover actions
-//
-// If you have read/write permissions for Amazon CloudWatch but not for Amazon
-// EC2, you can still create an alarm, but the stop or terminate actions are
-// not performed. However, if you are later granted the required permissions,
-// the alarm actions that you created earlier are performed.
-//
-// If you are using an IAM role (for example, an EC2 instance profile), you
-// cannot stop or terminate the instance using alarm actions. However, you can
-// still see the alarm state and perform any other actions such as Amazon SNS
-// notifications or Auto Scaling policies.
-//
-// If you are using temporary security credentials granted using AWS STS, you
-// cannot stop or terminate an EC2 instance using alarm actions.
+//    * The iam:CreateServiceLinkedRole to create an alarm with Systems Manager
+//    OpsItem actions.
 //
 // The first time you create an alarm in the AWS Management Console, the CLI,
 // or by using the PutMetricAlarm API, CloudWatch creates the necessary service-linked
-// role for you. The service-linked role is called AWSServiceRoleForCloudWatchEvents.
-// For more information, see AWS service-linked role (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-service-linked-role).
+// rolea for you. The service-linked roles are called AWSServiceRoleForCloudWatchEvents
+// and AWSServiceRoleForCloudWatchAlarms_ActionSSM. For more information, see
+// AWS service-linked role (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-service-linked-role).
 //
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
 // with awserr.Error's Code and Message methods to get detailed information about
@@ -2866,6 +2856,10 @@ func (c *CloudWatch) PutMetricDataRequest(input *PutMetricDataInput) (req *reque
 // information about specifying dimensions, see Publishing Metrics (https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/publishingMetrics.html)
 // in the Amazon CloudWatch User Guide.
 //
+// You specify the time stamp to be associated with each data point. You can
+// specify time stamps that are as much as two weeks before the current date,
+// and as much as 2 hours after the current day and time.
+//
 // Data points with time stamps from 24 hours ago or longer can take at least
 // 48 hours to become available for GetMetricData (https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_GetMetricData.html)
 // or GetMetricStatistics (https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_GetMetricStatistics.html)
@@ -2982,8 +2976,8 @@ func (c *CloudWatch) SetAlarmStateRequest(input *SetAlarmStateInput) (req *reque
 // DescribeAlarmHistory (https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_DescribeAlarmHistory.html).
 //
 // If you use SetAlarmState on a composite alarm, the composite alarm is not
-// guaranteed to return to its actual state. It will return to its actual state
-// only once any of its children alarms change state. It is also re-evaluated
+// guaranteed to return to its actual state. It returns to its actual state
+// only once any of its children alarms change state. It is also reevaluated
 // if you update its configuration.
 //
 // If an alarm triggers EC2 Auto Scaling policies or application Auto Scaling
@@ -3076,7 +3070,7 @@ func (c *CloudWatch) TagResourceRequest(input *TagResourceInput) (req *request.R
 // Contributor Insights rules.
 //
 // Tags can help you organize and categorize your resources. You can also use
-// them to scope user permissions, by granting a user permission to access or
+// them to scope user permissions by granting a user permission to access or
 // change only resources with certain tag values.
 //
 // Tags don't have any semantic meaning to AWS and are interpreted strictly
@@ -4321,8 +4315,8 @@ type DescribeAlarmsInput struct {
 	// is not returned.
 	//
 	// If you specify ChildrenOfAlarmName, you cannot specify any other parameters
-	// in the request except for MaxRecords and NextToken. If you do so, you will
-	// receive a validation error.
+	// in the request except for MaxRecords and NextToken. If you do so, you receive
+	// a validation error.
 	//
 	// Only the Alarm Name, ARN, StateValue (OK/ALARM/INSUFFICIENT_DATA), and StateUpdatedTimestamp
 	// information are returned by this operation when you use this parameter. To
@@ -4344,8 +4338,8 @@ type DescribeAlarmsInput struct {
 	// alarm that you specify in ParentsOfAlarmName is not returned.
 	//
 	// If you specify ParentsOfAlarmName, you cannot specify any other parameters
-	// in the request except for MaxRecords and NextToken. If you do so, you will
-	// receive a validation error.
+	// in the request except for MaxRecords and NextToken. If you do so, you receive
+	// a validation error.
 	//
 	// Only the Alarm Name and ARN are returned by this operation when you use this
 	// parameter. To get complete information about these alarms, perform another
@@ -4623,11 +4617,12 @@ func (s *DescribeAnomalyDetectorsOutput) SetNextToken(v string) *DescribeAnomaly
 type DescribeInsightRulesInput struct {
 	_ struct{} `type:"structure"`
 
-	// This parameter is not currently used. Reserved for future use. If it is used
-	// in the future, the maximum value may be different.
+	// The maximum number of results to return in one operation. If you omit this
+	// parameter, the default of 500 is used.
 	MaxResults *int64 `min:"1" type:"integer"`
 
-	// Reserved for future use.
+	// Include this value, if it was returned by the previous operation, to get
+	// the next set of rules.
 	NextToken *string `type:"string"`
 }
 
@@ -4672,7 +4667,8 @@ type DescribeInsightRulesOutput struct {
 	// The rules returned by the operation.
 	InsightRules []*InsightRule `type:"list"`
 
-	// Reserved for future use.
+	// If this parameter is present, it is a token that marks the start of the next
+	// batch of returned results.
 	NextToken *string `type:"string"`
 }
 
@@ -4698,16 +4694,21 @@ func (s *DescribeInsightRulesOutput) SetNextToken(v string) *DescribeInsightRule
 	return s
 }
 
-// Expands the identity of a metric.
+// A dimension is a name/value pair that is part of the identity of a metric.
+// You can assign up to 10 dimensions to a metric. Because dimensions are part
+// of the unique identifier for a metric, whenever you add a unique name/value
+// pair to one of your metrics, you are creating a new variation of that metric.
 type Dimension struct {
 	_ struct{} `type:"structure"`
 
-	// The name of the dimension.
+	// The name of the dimension. Dimension names cannot contain blank spaces or
+	// non-ASCII characters.
 	//
 	// Name is a required field
 	Name *string `min:"1" type:"string" required:"true"`
 
-	// The value representing the dimension measurement.
+	// The value of the dimension. Dimension values cannot contain blank spaces
+	// or non-ASCII characters.
 	//
 	// Value is a required field
 	Value *string `min:"1" type:"string" required:"true"`
@@ -5142,7 +5143,7 @@ type GetInsightRuleReportInput struct {
 	//    point.
 	//
 	//    * MaxContributorValue -- the value of the top contributor for each data
-	//    point. The identity of the contributor may change for each data point
+	//    point. The identity of the contributor might change for each data point
 	//    in the graph. If this rule aggregates by COUNT, the top contributor for
 	//    each data point is the contributor with the most occurrences in that period.
 	//    If the rule aggregates by SUM, the top contributor is the contributor
@@ -5373,8 +5374,8 @@ type GetMetricDataInput struct {
 	// MetricDataQueries is a required field
 	MetricDataQueries []*MetricDataQuery `type:"list" required:"true"`
 
-	// Include this value, if it was returned by the previous call, to get the next
-	// set of data points.
+	// Include this value, if it was returned by the previous GetMetricData operation,
+	// to get the next set of data points.
 	NextToken *string `type:"string"`
 
 	// The order in which data points should be returned. TimestampDescending returns
@@ -5496,7 +5497,7 @@ type GetMetricDataOutput struct {
 	_ struct{} `type:"structure"`
 
 	// Contains a message about this GetMetricData operation, if the operation results
-	// in such a message. An example of a message that may be returned is Maximum
+	// in such a message. An example of a message that might be returned is Maximum
 	// number of allowed metrics exceeded. If there is a message, as much of the
 	// operation as possible is still executed.
 	//
@@ -5640,9 +5641,9 @@ type GetMetricStatisticsInput struct {
 	// The unit for a given metric. If you omit Unit, all data that was collected
 	// with any unit is returned, along with the corresponding units that were specified
 	// when the data was reported to CloudWatch. If you specify a unit, the operation
-	// returns only data data that was collected with that unit specified. If you
-	// specify a unit that does not match the data collected, the results of the
-	// operation are null. CloudWatch does not perform unit conversions.
+	// returns only data that was collected with that unit specified. If you specify
+	// a unit that does not match the data collected, the results of the operation
+	// are null. CloudWatch does not perform unit conversions.
 	Unit *string `type:"string" enum:"StandardUnit"`
 }
 
@@ -5880,7 +5881,7 @@ func (s *GetMetricWidgetImageInput) SetOutputFormat(v string) *GetMetricWidgetIm
 type GetMetricWidgetImageOutput struct {
 	_ struct{} `type:"structure"`
 
-	// The image of the graph, in the output format specified.
+	// The image of the graph, in the output format specified. The output is base64-encoded.
 	//
 	// MetricWidgetImage is automatically base64 encoded/decoded by the SDK.
 	MetricWidgetImage []byte `type:"blob"`
@@ -6251,18 +6252,30 @@ func (s *ListDashboardsOutput) SetNextToken(v string) *ListDashboardsOutput {
 type ListMetricsInput struct {
 	_ struct{} `type:"structure"`
 
-	// The dimensions to filter against.
+	// The dimensions to filter against. Only the dimensions that match exactly
+	// will be returned.
 	Dimensions []*DimensionFilter `type:"list"`
 
-	// The name of the metric to filter against.
+	// The name of the metric to filter against. Only the metrics with names that
+	// match exactly will be returned.
 	MetricName *string `min:"1" type:"string"`
 
-	// The namespace to filter against.
+	// The metric namespace to filter against. Only the namespace that matches exactly
+	// will be returned.
 	Namespace *string `min:"1" type:"string"`
 
 	// The token returned by a previous call to indicate that there is more data
 	// available.
 	NextToken *string `type:"string"`
+
+	// To filter the results to show only metrics that have had data points published
+	// in the past three hours, specify this parameter with a value of PT3H. This
+	// is the only valid value for this parameter.
+	//
+	// The results that are returned are an approximation of the value you specify.
+	// There is a low probability that the returned results include metrics with
+	// last published data as much as 40 minutes more than the specified time interval.
+	RecentlyActive *string `type:"string" enum:"RecentlyActive"`
 }
 
 // String returns the string representation
@@ -6325,10 +6338,16 @@ func (s *ListMetricsInput) SetNextToken(v string) *ListMetricsInput {
 	return s
 }
 
+// SetRecentlyActive sets the RecentlyActive field's value.
+func (s *ListMetricsInput) SetRecentlyActive(v string) *ListMetricsInput {
+	s.RecentlyActive = &v
+	return s
+}
+
 type ListMetricsOutput struct {
 	_ struct{} `type:"structure"`
 
-	// The metrics.
+	// The metrics that match your request.
 	Metrics []*Metric `type:"list"`
 
 	// The token that marks the start of the next batch of returned results.
@@ -6366,7 +6385,7 @@ type ListTagsForResourceInput struct {
 	//
 	// The ARN format of a Contributor Insights rule is arn:aws:cloudwatch:Region:account-id:insight-rule:insight-rule-name
 	//
-	// For more information on ARN format, see Resource Types Defined by Amazon
+	// For more information about ARN format, see Resource Types Defined by Amazon
 	// CloudWatch (https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazoncloudwatch.html#amazoncloudwatch-resources-for-iam-policies)
 	// in the Amazon Web Services General Reference.
 	//
@@ -6589,7 +6608,7 @@ type MetricAlarm struct {
 	// An array of MetricDataQuery structures, used in an alarm based on a metric
 	// math expression. Each structure either retrieves a metric or performs a math
 	// expression. One item in the Metrics array is the math expression that the
-	// alarm watches. This expression by designated by having ReturnValue set to
+	// alarm watches. This expression by designated by having ReturnData set to
 	// true.
 	Metrics []*MetricDataQuery `type:"list"`
 
@@ -7251,9 +7270,9 @@ type MetricStat struct {
 	// In a Get operation, if you omit Unit then all data that was collected with
 	// any unit is returned, along with the corresponding units that were specified
 	// when the data was reported to CloudWatch. If you specify a unit, the operation
-	// returns only data data that was collected with that unit specified. If you
-	// specify a unit that does not match the data collected, the results of the
-	// operation are null. CloudWatch does not perform unit conversions.
+	// returns only data that was collected with that unit specified. If you specify
+	// a unit that does not match the data collected, the results of the operation
+	// are null. CloudWatch does not perform unit conversions.
 	Unit *string `type:"string" enum:"StandardUnit"`
 }
 
@@ -7379,8 +7398,6 @@ type PutAnomalyDetectorInput struct {
 	// the model. You can specify as many as 10 time ranges.
 	//
 	// The configuration can also include the time zone to use for the metric.
-	//
-	// You can in
 	Configuration *AnomalyDetectorConfiguration `type:"structure"`
 
 	// The metric dimensions to create the anomaly detection model for.
@@ -7506,14 +7523,13 @@ type PutCompositeAlarmInput struct {
 	// The actions to execute when this alarm transitions to the ALARM state from
 	// any other state. Each action is specified as an Amazon Resource Name (ARN).
 	//
-	// Valid Values: arn:aws:sns:region:account-id:sns-topic-name
+	// Valid Values: arn:aws:sns:region:account-id:sns-topic-name | arn:aws:ssm:region:account-id:opsitem:severity
 	AlarmActions []*string `type:"list"`
 
 	// The description for the composite alarm.
 	AlarmDescription *string `type:"string"`
 
-	// The name for the composite alarm. This name must be unique within your AWS
-	// account.
+	// The name for the composite alarm. This name must be unique within the Region.
 	//
 	// AlarmName is a required field
 	AlarmName *string `min:"1" type:"string" required:"true"`
@@ -7767,7 +7783,7 @@ type PutDashboardOutput struct {
 	//
 	// If this result includes only warning messages, then the input was valid enough
 	// for the dashboard to be created or modified, but some elements of the dashboard
-	// may not render.
+	// might not render.
 	//
 	// If this result includes error messages, the input was not valid and the operation
 	// failed.
@@ -7919,6 +7935,7 @@ type PutMetricAlarmInput struct {
 	// Valid Values: arn:aws:automate:region:ec2:stop | arn:aws:automate:region:ec2:terminate
 	// | arn:aws:automate:region:ec2:recover | arn:aws:automate:region:ec2:reboot
 	// | arn:aws:sns:region:account-id:sns-topic-name | arn:aws:autoscaling:region:account-id:scalingPolicy:policy-id:autoScalingGroupName/group-friendly-name:policyName/policy-friendly-name
+	// | arn:aws:ssm:region:account-id:opsitem:severity
 	//
 	// Valid Values (for use with IAM roles): arn:aws:swf:region:account-id:action/actions/AWS_EC2.InstanceId.Stop/1.0
 	// | arn:aws:swf:region:account-id:action/actions/AWS_EC2.InstanceId.Terminate/1.0
@@ -7928,7 +7945,7 @@ type PutMetricAlarmInput struct {
 	// The description for the alarm.
 	AlarmDescription *string `type:"string"`
 
-	// The name for the alarm. This name must be unique within your AWS account.
+	// The name for the alarm. This name must be unique within the Region.
 	//
 	// AlarmName is a required field
 	AlarmName *string `min:"1" type:"string" required:"true"`
@@ -8009,8 +8026,8 @@ type PutMetricAlarmInput struct {
 	// expression.
 	//
 	// One item in the Metrics array is the expression that the alarm watches. You
-	// designate this expression by setting ReturnValue to true for this object
-	// in the array. For more information, see MetricDataQuery (https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_MetricDataQuery.html).
+	// designate this expression by setting ReturnData to true for this object in
+	// the array. For more information, see MetricDataQuery (https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_MetricDataQuery.html).
 	//
 	// If you use the Metrics parameter, you cannot include the MetricName, Dimensions,
 	// Period, Namespace, Statistic, or ExtendedStatistic parameters of PutMetricAlarm
@@ -8045,7 +8062,7 @@ type PutMetricAlarmInput struct {
 	// a metric that does not have sub-minute resolution, the alarm still attempts
 	// to gather data at the period rate that you specify. In this case, it does
 	// not receive data for the attempts that do not correspond to a one-minute
-	// data resolution, and the alarm may often lapse into INSUFFICENT_DATA status.
+	// data resolution, and the alarm might often lapse into INSUFFICENT_DATA status.
 	// Specifying 10 or 30 also sets this alarm as a high-resolution alarm, which
 	// has a higher charge than other alarms. For more information about pricing,
 	// see Amazon CloudWatch Pricing (https://aws.amazon.com/cloudwatch/pricing/).
@@ -8064,8 +8081,13 @@ type PutMetricAlarmInput struct {
 	// as many as 50 tags with an alarm.
 	//
 	// Tags can help you organize and categorize your resources. You can also use
-	// them to scope user permissions, by granting a user permission to access or
+	// them to scope user permissions by granting a user permission to access or
 	// change only resources with certain tag values.
+	//
+	// If you are using this operation to update an existing alarm, any tags you
+	// specify in this parameter are ignored. To change the tags of an existing
+	// alarm, use TagResource (https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_TagResource.html)
+	// or UntagResource (https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_UntagResource.html).
 	Tags []*Tag `type:"list"`
 
 	// The value against which the specified statistic is compared.
@@ -8098,12 +8120,12 @@ type PutMetricAlarmInput struct {
 	// Percent, are aggregated separately.
 	//
 	// If you don't specify Unit, CloudWatch retrieves all unit types that have
-	// been published for the metric and attempts to evaluate the alarm. Usually
-	// metrics are published with only one unit, so the alarm will work as intended.
+	// been published for the metric and attempts to evaluate the alarm. Usually,
+	// metrics are published with only one unit, so the alarm works as intended.
 	//
 	// However, if the metric is published with multiple types of units and you
-	// don't specify a unit, the alarm's behavior is not defined and will behave
-	// un-predictably.
+	// don't specify a unit, the alarm's behavior is not defined and it behaves
+	// predictably.
 	//
 	// We recommend omitting Unit so that you don't inadvertently specify an incorrect
 	// unit that is not published for this metric. Doing so causes the alarm to
@@ -8485,8 +8507,7 @@ func (s *Range) SetStartTime(v time.Time) *Range {
 type SetAlarmStateInput struct {
 	_ struct{} `type:"structure"`
 
-	// The name for the alarm. This name must be unique within the AWS account.
-	// The maximum length is 255 characters.
+	// The name of the alarm.
 	//
 	// AlarmName is a required field
 	AlarmName *string `min:"1" type:"string" required:"true"`
@@ -8726,7 +8747,7 @@ type TagResourceInput struct {
 	//
 	// The ARN format of a Contributor Insights rule is arn:aws:cloudwatch:Region:account-id:insight-rule:insight-rule-name
 	//
-	// For more information on ARN format, see Resource Types Defined by Amazon
+	// For more information about ARN format, see Resource Types Defined by Amazon
 	// CloudWatch (https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazoncloudwatch.html#amazoncloudwatch-resources-for-iam-policies)
 	// in the Amazon Web Services General Reference.
 	//
@@ -8813,7 +8834,7 @@ type UntagResourceInput struct {
 	//
 	// The ARN format of a Contributor Insights rule is arn:aws:cloudwatch:Region:account-id:insight-rule:insight-rule-name
 	//
-	// For more information on ARN format, see Resource Types Defined by Amazon
+	// For more information about ARN format, see Resource Types Defined by Amazon
 	// CloudWatch (https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazoncloudwatch.html#amazoncloudwatch-resources-for-iam-policies)
 	// in the Amazon Web Services General Reference.
 	//
@@ -8889,6 +8910,14 @@ const (
 	AlarmTypeMetricAlarm = "MetricAlarm"
 )
 
+// AlarmType_Values returns all elements of the AlarmType enum
+func AlarmType_Values() []string {
+	return []string{
+		AlarmTypeCompositeAlarm,
+		AlarmTypeMetricAlarm,
+	}
+}
+
 const (
 	// AnomalyDetectorStateValuePendingTraining is a AnomalyDetectorStateValue enum value
 	AnomalyDetectorStateValuePendingTraining = "PENDING_TRAINING"
@@ -8900,6 +8929,15 @@ const (
 	AnomalyDetectorStateValueTrained = "TRAINED"
 )
 
+// AnomalyDetectorStateValue_Values returns all elements of the AnomalyDetectorStateValue enum
+func AnomalyDetectorStateValue_Values() []string {
+	return []string{
+		AnomalyDetectorStateValuePendingTraining,
+		AnomalyDetectorStateValueTrainedInsufficientData,
+		AnomalyDetectorStateValueTrained,
+	}
+}
+
 const (
 	// ComparisonOperatorGreaterThanOrEqualToThreshold is a ComparisonOperator enum value
 	ComparisonOperatorGreaterThanOrEqualToThreshold = "GreaterThanOrEqualToThreshold"
@@ -8923,6 +8961,19 @@ const (
 	ComparisonOperatorGreaterThanUpperThreshold = "GreaterThanUpperThreshold"
 )
 
+// ComparisonOperator_Values returns all elements of the ComparisonOperator enum
+func ComparisonOperator_Values() []string {
+	return []string{
+		ComparisonOperatorGreaterThanOrEqualToThreshold,
+		ComparisonOperatorGreaterThanThreshold,
+		ComparisonOperatorLessThanThreshold,
+		ComparisonOperatorLessThanOrEqualToThreshold,
+		ComparisonOperatorLessThanLowerOrGreaterThanUpperThreshold,
+		ComparisonOperatorLessThanLowerThreshold,
+		ComparisonOperatorGreaterThanUpperThreshold,
+	}
+}
+
 const (
 	// HistoryItemTypeConfigurationUpdate is a HistoryItemType enum value
 	HistoryItemTypeConfigurationUpdate = "ConfigurationUpdate"
@@ -8934,6 +8985,27 @@ const (
 	HistoryItemTypeAction = "Action"
 )
 
+// HistoryItemType_Values returns all elements of the HistoryItemType enum
+func HistoryItemType_Values() []string {
+	return []string{
+		HistoryItemTypeConfigurationUpdate,
+		HistoryItemTypeStateUpdate,
+		HistoryItemTypeAction,
+	}
+}
+
+const (
+	// RecentlyActivePt3h is a RecentlyActive enum value
+	RecentlyActivePt3h = "PT3H"
+)
+
+// RecentlyActive_Values returns all elements of the RecentlyActive enum
+func RecentlyActive_Values() []string {
+	return []string{
+		RecentlyActivePt3h,
+	}
+}
+
 const (
 	// ScanByTimestampDescending is a ScanBy enum value
 	ScanByTimestampDescending = "TimestampDescending"
@@ -8942,6 +9014,14 @@ const (
 	ScanByTimestampAscending = "TimestampAscending"
 )
 
+// ScanBy_Values returns all elements of the ScanBy enum
+func ScanBy_Values() []string {
+	return []string{
+		ScanByTimestampDescending,
+		ScanByTimestampAscending,
+	}
+}
+
 const (
 	// StandardUnitSeconds is a StandardUnit enum value
 	StandardUnitSeconds = "Seconds"
@@ -9025,6 +9105,39 @@ const (
 	StandardUnitNone = "None"
 )
 
+// StandardUnit_Values returns all elements of the StandardUnit enum
+func StandardUnit_Values() []string {
+	return []string{
+		StandardUnitSeconds,
+		StandardUnitMicroseconds,
+		StandardUnitMilliseconds,
+		StandardUnitBytes,
+		StandardUnitKilobytes,
+		StandardUnitMegabytes,
+		StandardUnitGigabytes,
+		StandardUnitTerabytes,
+		StandardUnitBits,
+		StandardUnitKilobits,
+		StandardUnitMegabits,
+		StandardUnitGigabits,
+		StandardUnitTerabits,
+		StandardUnitPercent,
+		StandardUnitCount,
+		StandardUnitBytesSecond,
+		StandardUnitKilobytesSecond,
+		StandardUnitMegabytesSecond,
+		StandardUnitGigabytesSecond,
+		StandardUnitTerabytesSecond,
+		StandardUnitBitsSecond,
+		StandardUnitKilobitsSecond,
+		StandardUnitMegabitsSecond,
+		StandardUnitGigabitsSecond,
+		StandardUnitTerabitsSecond,
+		StandardUnitCountSecond,
+		StandardUnitNone,
+	}
+}
+
 const (
 	// StateValueOk is a StateValue enum value
 	StateValueOk = "OK"
@@ -9036,6 +9149,15 @@ const (
 	StateValueInsufficientData = "INSUFFICIENT_DATA"
 )
 
+// StateValue_Values returns all elements of the StateValue enum
+func StateValue_Values() []string {
+	return []string{
+		StateValueOk,
+		StateValueAlarm,
+		StateValueInsufficientData,
+	}
+}
+
 const (
 	// StatisticSampleCount is a Statistic enum value
 	StatisticSampleCount = "SampleCount"
@@ -9053,6 +9175,17 @@ const (
 	StatisticMaximum = "Maximum"
 )
 
+// Statistic_Values returns all elements of the Statistic enum
+func Statistic_Values() []string {
+	return []string{
+		StatisticSampleCount,
+		StatisticAverage,
+		StatisticSum,
+		StatisticMinimum,
+		StatisticMaximum,
+	}
+}
+
 const (
 	// StatusCodeComplete is a StatusCode enum value
 	StatusCodeComplete = "Complete"
@@ -9063,3 +9196,12 @@ const (
 	// StatusCodePartialData is a StatusCode enum value
 	StatusCodePartialData = "PartialData"
 )
+
+// StatusCode_Values returns all elements of the StatusCode enum
+func StatusCode_Values() []string {
+	return []string{
+		StatusCodeComplete,
+		StatusCodeInternalError,
+		StatusCodePartialData,
+	}
+}

vendor/github.com/aws/aws-sdk-go/service/ec2/customizations.go

@@ -26,8 +26,12 @@ func init() {
 
 		// only set the retryer on request if config doesn't have a retryer
 		if r.Config.Retryer == nil && (r.Operation.Name == opModifyNetworkInterfaceAttribute || r.Operation.Name == opAssignPrivateIpAddresses) {
+			maxRetries := client.DefaultRetryerMaxNumRetries
+			if m := r.Config.MaxRetries; m != nil && *m != aws.UseServiceDefaultRetries {
+				maxRetries = *m
+			}
 			r.Retryer = client.DefaultRetryer{
-				NumMaxRetries:    client.DefaultRetryerMaxNumRetries,
+				NumMaxRetries:    maxRetries,
 				MinRetryDelay:    customRetryerMinRetryDelay,
 				MinThrottleDelay: customRetryerMinRetryDelay,
 				MaxRetryDelay:    customRetryerMaxRetryDelay,

vendor/github.com/aws/aws-sdk-go/service/elasticache/doc.go

@@ -0,0 +1,38 @@
+// Code generated by private/model/cli/gen-api/main.go. DO NOT EDIT.
+
+// Package elasticache provides the client and types for making API
+// requests to Amazon ElastiCache.
+//
+// Amazon ElastiCache is a web service that makes it easier to set up, operate,
+// and scale a distributed cache in the cloud.
+//
+// With ElastiCache, customers get all of the benefits of a high-performance,
+// in-memory cache with less of the administrative burden involved in launching
+// and managing a distributed cache. The service makes setup, scaling, and cluster
+// failure handling much simpler than in a self-managed cache deployment.
+//
+// In addition, through integration with Amazon CloudWatch, customers get enhanced
+// visibility into the key performance statistics associated with their cache
+// and can receive alarms if a part of their cache runs hot.
+//
+// See https://docs.aws.amazon.com/goto/WebAPI/elasticache-2015-02-02 for more information on this service.
+//
+// See elasticache package documentation for more information.
+// https://docs.aws.amazon.com/sdk-for-go/api/service/elasticache/
+//
+// Using the Client
+//
+// To contact Amazon ElastiCache with the SDK use the New function to create
+// a new service client. With that client you can make API requests to the service.
+// These clients are safe to use concurrently.
+//
+// See the SDK's documentation for more information on how to use the SDK.
+// https://docs.aws.amazon.com/sdk-for-go/api/
+//
+// See aws.Config documentation for more information on configuring SDK clients.
+// https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config
+//
+// See the Amazon ElastiCache client ElastiCache for more
+// information on creating client for this service.
+// https://docs.aws.amazon.com/sdk-for-go/api/service/elasticache/#New
+package elasticache

vendor/github.com/aws/aws-sdk-go/service/elasticache/errors.go

@@ -0,0 +1,442 @@
+// Code generated by private/model/cli/gen-api/main.go. DO NOT EDIT.
+
+package elasticache
+
+const (
+
+	// ErrCodeAPICallRateForCustomerExceededFault for service response error code
+	// "APICallRateForCustomerExceeded".
+	//
+	// The customer has exceeded the allowed rate of API calls.
+	ErrCodeAPICallRateForCustomerExceededFault = "APICallRateForCustomerExceeded"
+
+	// ErrCodeAuthorizationAlreadyExistsFault for service response error code
+	// "AuthorizationAlreadyExists".
+	//
+	// The specified Amazon EC2 security group is already authorized for the specified
+	// cache security group.
+	ErrCodeAuthorizationAlreadyExistsFault = "AuthorizationAlreadyExists"
+
+	// ErrCodeAuthorizationNotFoundFault for service response error code
+	// "AuthorizationNotFound".
+	//
+	// The specified Amazon EC2 security group is not authorized for the specified
+	// cache security group.
+	ErrCodeAuthorizationNotFoundFault = "AuthorizationNotFound"
+
+	// ErrCodeCacheClusterAlreadyExistsFault for service response error code
+	// "CacheClusterAlreadyExists".
+	//
+	// You already have a cluster with the given identifier.
+	ErrCodeCacheClusterAlreadyExistsFault = "CacheClusterAlreadyExists"
+
+	// ErrCodeCacheClusterNotFoundFault for service response error code
+	// "CacheClusterNotFound".
+	//
+	// The requested cluster ID does not refer to an existing cluster.
+	ErrCodeCacheClusterNotFoundFault = "CacheClusterNotFound"
+
+	// ErrCodeCacheParameterGroupAlreadyExistsFault for service response error code
+	// "CacheParameterGroupAlreadyExists".
+	//
+	// A cache parameter group with the requested name already exists.
+	ErrCodeCacheParameterGroupAlreadyExistsFault = "CacheParameterGroupAlreadyExists"
+
+	// ErrCodeCacheParameterGroupNotFoundFault for service response error code
+	// "CacheParameterGroupNotFound".
+	//
+	// The requested cache parameter group name does not refer to an existing cache
+	// parameter group.
+	ErrCodeCacheParameterGroupNotFoundFault = "CacheParameterGroupNotFound"
+
+	// ErrCodeCacheParameterGroupQuotaExceededFault for service response error code
+	// "CacheParameterGroupQuotaExceeded".
+	//
+	// The request cannot be processed because it would exceed the maximum number
+	// of cache security groups.
+	ErrCodeCacheParameterGroupQuotaExceededFault = "CacheParameterGroupQuotaExceeded"
+
+	// ErrCodeCacheSecurityGroupAlreadyExistsFault for service response error code
+	// "CacheSecurityGroupAlreadyExists".
+	//
+	// A cache security group with the specified name already exists.
+	ErrCodeCacheSecurityGroupAlreadyExistsFault = "CacheSecurityGroupAlreadyExists"
+
+	// ErrCodeCacheSecurityGroupNotFoundFault for service response error code
+	// "CacheSecurityGroupNotFound".
+	//
+	// The requested cache security group name does not refer to an existing cache
+	// security group.
+	ErrCodeCacheSecurityGroupNotFoundFault = "CacheSecurityGroupNotFound"
+
+	// ErrCodeCacheSecurityGroupQuotaExceededFault for service response error code
+	// "QuotaExceeded.CacheSecurityGroup".
+	//
+	// The request cannot be processed because it would exceed the allowed number
+	// of cache security groups.
+	ErrCodeCacheSecurityGroupQuotaExceededFault = "QuotaExceeded.CacheSecurityGroup"
+
+	// ErrCodeCacheSubnetGroupAlreadyExistsFault for service response error code
+	// "CacheSubnetGroupAlreadyExists".
+	//
+	// The requested cache subnet group name is already in use by an existing cache
+	// subnet group.
+	ErrCodeCacheSubnetGroupAlreadyExistsFault = "CacheSubnetGroupAlreadyExists"
+
+	// ErrCodeCacheSubnetGroupInUse for service response error code
+	// "CacheSubnetGroupInUse".
+	//
+	// The requested cache subnet group is currently in use.
+	ErrCodeCacheSubnetGroupInUse = "CacheSubnetGroupInUse"
+
+	// ErrCodeCacheSubnetGroupNotFoundFault for service response error code
+	// "CacheSubnetGroupNotFoundFault".
+	//
+	// The requested cache subnet group name does not refer to an existing cache
+	// subnet group.
+	ErrCodeCacheSubnetGroupNotFoundFault = "CacheSubnetGroupNotFoundFault"
+
+	// ErrCodeCacheSubnetGroupQuotaExceededFault for service response error code
+	// "CacheSubnetGroupQuotaExceeded".
+	//
+	// The request cannot be processed because it would exceed the allowed number
+	// of cache subnet groups.
+	ErrCodeCacheSubnetGroupQuotaExceededFault = "CacheSubnetGroupQuotaExceeded"
+
+	// ErrCodeCacheSubnetQuotaExceededFault for service response error code
+	// "CacheSubnetQuotaExceededFault".
+	//
+	// The request cannot be processed because it would exceed the allowed number
+	// of subnets in a cache subnet group.
+	ErrCodeCacheSubnetQuotaExceededFault = "CacheSubnetQuotaExceededFault"
+
+	// ErrCodeClusterQuotaForCustomerExceededFault for service response error code
+	// "ClusterQuotaForCustomerExceeded".
+	//
+	// The request cannot be processed because it would exceed the allowed number
+	// of clusters per customer.
+	ErrCodeClusterQuotaForCustomerExceededFault = "ClusterQuotaForCustomerExceeded"
+
+	// ErrCodeDefaultUserAssociatedToUserGroupFault for service response error code
+	// "DefaultUserAssociatedToUserGroup".
+	ErrCodeDefaultUserAssociatedToUserGroupFault = "DefaultUserAssociatedToUserGroup"
+
+	// ErrCodeDefaultUserRequired for service response error code
+	// "DefaultUserRequired".
+	//
+	// You must add default user to a user group.
+	ErrCodeDefaultUserRequired = "DefaultUserRequired"
+
+	// ErrCodeDuplicateUserNameFault for service response error code
+	// "DuplicateUserName".
+	//
+	// A user with this username already exists.
+	ErrCodeDuplicateUserNameFault = "DuplicateUserName"
+
+	// ErrCodeGlobalReplicationGroupAlreadyExistsFault for service response error code
+	// "GlobalReplicationGroupAlreadyExistsFault".
+	//
+	// The Global Datastore name already exists.
+	ErrCodeGlobalReplicationGroupAlreadyExistsFault = "GlobalReplicationGroupAlreadyExistsFault"
+
+	// ErrCodeGlobalReplicationGroupNotFoundFault for service response error code
+	// "GlobalReplicationGroupNotFoundFault".
+	//
+	// The Global Datastore does not exist
+	ErrCodeGlobalReplicationGroupNotFoundFault = "GlobalReplicationGroupNotFoundFault"
+
+	// ErrCodeInsufficientCacheClusterCapacityFault for service response error code
+	// "InsufficientCacheClusterCapacity".
+	//
+	// The requested cache node type is not available in the specified Availability
+	// Zone. For more information, see InsufficientCacheClusterCapacity (http://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/ErrorMessages.html#ErrorMessages.INSUFFICIENT_CACHE_CLUSTER_CAPACITY)
+	// in the ElastiCache User Guide.
+	ErrCodeInsufficientCacheClusterCapacityFault = "InsufficientCacheClusterCapacity"
+
+	// ErrCodeInvalidARNFault for service response error code
+	// "InvalidARN".
+	//
+	// The requested Amazon Resource Name (ARN) does not refer to an existing resource.
+	ErrCodeInvalidARNFault = "InvalidARN"
+
+	// ErrCodeInvalidCacheClusterStateFault for service response error code
+	// "InvalidCacheClusterState".
+	//
+	// The requested cluster is not in the available state.
+	ErrCodeInvalidCacheClusterStateFault = "InvalidCacheClusterState"
+
+	// ErrCodeInvalidCacheParameterGroupStateFault for service response error code
+	// "InvalidCacheParameterGroupState".
+	//
+	// The current state of the cache parameter group does not allow the requested
+	// operation to occur.
+	ErrCodeInvalidCacheParameterGroupStateFault = "InvalidCacheParameterGroupState"
+
+	// ErrCodeInvalidCacheSecurityGroupStateFault for service response error code
+	// "InvalidCacheSecurityGroupState".
+	//
+	// The current state of the cache security group does not allow deletion.
+	ErrCodeInvalidCacheSecurityGroupStateFault = "InvalidCacheSecurityGroupState"
+
+	// ErrCodeInvalidGlobalReplicationGroupStateFault for service response error code
+	// "InvalidGlobalReplicationGroupState".
+	//
+	// The Global Datastore is not available or in primary-only state.
+	ErrCodeInvalidGlobalReplicationGroupStateFault = "InvalidGlobalReplicationGroupState"
+
+	// ErrCodeInvalidKMSKeyFault for service response error code
+	// "InvalidKMSKeyFault".
+	//
+	// The KMS key supplied is not valid.
+	ErrCodeInvalidKMSKeyFault = "InvalidKMSKeyFault"
+
+	// ErrCodeInvalidParameterCombinationException for service response error code
+	// "InvalidParameterCombination".
+	//
+	// Two or more incompatible parameters were specified.
+	ErrCodeInvalidParameterCombinationException = "InvalidParameterCombination"
+
+	// ErrCodeInvalidParameterValueException for service response error code
+	// "InvalidParameterValue".
+	//
+	// The value for a parameter is invalid.
+	ErrCodeInvalidParameterValueException = "InvalidParameterValue"
+
+	// ErrCodeInvalidReplicationGroupStateFault for service response error code
+	// "InvalidReplicationGroupState".
+	//
+	// The requested replication group is not in the available state.
+	ErrCodeInvalidReplicationGroupStateFault = "InvalidReplicationGroupState"
+
+	// ErrCodeInvalidSnapshotStateFault for service response error code
+	// "InvalidSnapshotState".
+	//
+	// The current state of the snapshot does not allow the requested operation
+	// to occur.
+	ErrCodeInvalidSnapshotStateFault = "InvalidSnapshotState"
+
+	// ErrCodeInvalidSubnet for service response error code
+	// "InvalidSubnet".
+	//
+	// An invalid subnet identifier was specified.
+	ErrCodeInvalidSubnet = "InvalidSubnet"
+
+	// ErrCodeInvalidUserGroupStateFault for service response error code
+	// "InvalidUserGroupState".
+	//
+	// The user group is not in an active state.
+	ErrCodeInvalidUserGroupStateFault = "InvalidUserGroupState"
+
+	// ErrCodeInvalidUserStateFault for service response error code
+	// "InvalidUserState".
+	//
+	// The user is not in active state.
+	ErrCodeInvalidUserStateFault = "InvalidUserState"
+
+	// ErrCodeInvalidVPCNetworkStateFault for service response error code
+	// "InvalidVPCNetworkStateFault".
+	//
+	// The VPC network is in an invalid state.
+	ErrCodeInvalidVPCNetworkStateFault = "InvalidVPCNetworkStateFault"
+
+	// ErrCodeNoOperationFault for service response error code
+	// "NoOperationFault".
+	//
+	// The operation was not performed because no changes were required.
+	ErrCodeNoOperationFault = "NoOperationFault"
+
+	// ErrCodeNodeGroupNotFoundFault for service response error code
+	// "NodeGroupNotFoundFault".
+	//
+	// The node group specified by the NodeGroupId parameter could not be found.
+	// Please verify that the node group exists and that you spelled the NodeGroupId
+	// value correctly.
+	ErrCodeNodeGroupNotFoundFault = "NodeGroupNotFoundFault"
+
+	// ErrCodeNodeGroupsPerReplicationGroupQuotaExceededFault for service response error code
+	// "NodeGroupsPerReplicationGroupQuotaExceeded".
+	//
+	// The request cannot be processed because it would exceed the maximum allowed
+	// number of node groups (shards) in a single replication group. The default
+	// maximum is 90
+	ErrCodeNodeGroupsPerReplicationGroupQuotaExceededFault = "NodeGroupsPerReplicationGroupQuotaExceeded"
+
+	// ErrCodeNodeQuotaForClusterExceededFault for service response error code
+	// "NodeQuotaForClusterExceeded".
+	//
+	// The request cannot be processed because it would exceed the allowed number
+	// of cache nodes in a single cluster.
+	ErrCodeNodeQuotaForClusterExceededFault = "NodeQuotaForClusterExceeded"
+
+	// ErrCodeNodeQuotaForCustomerExceededFault for service response error code
+	// "NodeQuotaForCustomerExceeded".
+	//
+	// The request cannot be processed because it would exceed the allowed number
+	// of cache nodes per customer.
+	ErrCodeNodeQuotaForCustomerExceededFault = "NodeQuotaForCustomerExceeded"
+
+	// ErrCodeReplicationGroupAlreadyExistsFault for service response error code
+	// "ReplicationGroupAlreadyExists".
+	//
+	// The specified replication group already exists.
+	ErrCodeReplicationGroupAlreadyExistsFault = "ReplicationGroupAlreadyExists"
+
+	// ErrCodeReplicationGroupAlreadyUnderMigrationFault for service response error code
+	// "ReplicationGroupAlreadyUnderMigrationFault".
+	//
+	// The targeted replication group is not available.
+	ErrCodeReplicationGroupAlreadyUnderMigrationFault = "ReplicationGroupAlreadyUnderMigrationFault"
+
+	// ErrCodeReplicationGroupNotFoundFault for service response error code
+	// "ReplicationGroupNotFoundFault".
+	//
+	// The specified replication group does not exist.
+	ErrCodeReplicationGroupNotFoundFault = "ReplicationGroupNotFoundFault"
+
+	// ErrCodeReplicationGroupNotUnderMigrationFault for service response error code
+	// "ReplicationGroupNotUnderMigrationFault".
+	//
+	// The designated replication group is not available for data migration.
+	ErrCodeReplicationGroupNotUnderMigrationFault = "ReplicationGroupNotUnderMigrationFault"
+
+	// ErrCodeReservedCacheNodeAlreadyExistsFault for service response error code
+	// "ReservedCacheNodeAlreadyExists".
+	//
+	// You already have a reservation with the given identifier.
+	ErrCodeReservedCacheNodeAlreadyExistsFault = "ReservedCacheNodeAlreadyExists"
+
+	// ErrCodeReservedCacheNodeNotFoundFault for service response error code
+	// "ReservedCacheNodeNotFound".
+	//
+	// The requested reserved cache node was not found.
+	ErrCodeReservedCacheNodeNotFoundFault = "ReservedCacheNodeNotFound"
+
+	// ErrCodeReservedCacheNodeQuotaExceededFault for service response error code
+	// "ReservedCacheNodeQuotaExceeded".
+	//
+	// The request cannot be processed because it would exceed the user's cache
+	// node quota.
+	ErrCodeReservedCacheNodeQuotaExceededFault = "ReservedCacheNodeQuotaExceeded"
+
+	// ErrCodeReservedCacheNodesOfferingNotFoundFault for service response error code
+	// "ReservedCacheNodesOfferingNotFound".
+	//
+	// The requested cache node offering does not exist.
+	ErrCodeReservedCacheNodesOfferingNotFoundFault = "ReservedCacheNodesOfferingNotFound"
+
+	// ErrCodeServiceLinkedRoleNotFoundFault for service response error code
+	// "ServiceLinkedRoleNotFoundFault".
+	//
+	// The specified service linked role (SLR) was not found.
+	ErrCodeServiceLinkedRoleNotFoundFault = "ServiceLinkedRoleNotFoundFault"
+
+	// ErrCodeServiceUpdateNotFoundFault for service response error code
+	// "ServiceUpdateNotFoundFault".
+	//
+	// The service update doesn't exist
+	ErrCodeServiceUpdateNotFoundFault = "ServiceUpdateNotFoundFault"
+
+	// ErrCodeSnapshotAlreadyExistsFault for service response error code
+	// "SnapshotAlreadyExistsFault".
+	//
+	// You already have a snapshot with the given name.
+	ErrCodeSnapshotAlreadyExistsFault = "SnapshotAlreadyExistsFault"
+
+	// ErrCodeSnapshotFeatureNotSupportedFault for service response error code
+	// "SnapshotFeatureNotSupportedFault".
+	//
+	// You attempted one of the following operations:
+	//
+	//    * Creating a snapshot of a Redis cluster running on a cache.t1.micro cache
+	//    node.
+	//
+	//    * Creating a snapshot of a cluster that is running Memcached rather than
+	//    Redis.
+	//
+	// Neither of these are supported by ElastiCache.
+	ErrCodeSnapshotFeatureNotSupportedFault = "SnapshotFeatureNotSupportedFault"
+
+	// ErrCodeSnapshotNotFoundFault for service response error code
+	// "SnapshotNotFoundFault".
+	//
+	// The requested snapshot name does not refer to an existing snapshot.
+	ErrCodeSnapshotNotFoundFault = "SnapshotNotFoundFault"
+
+	// ErrCodeSnapshotQuotaExceededFault for service response error code
+	// "SnapshotQuotaExceededFault".
+	//
+	// The request cannot be processed because it would exceed the maximum number
+	// of snapshots.
+	ErrCodeSnapshotQuotaExceededFault = "SnapshotQuotaExceededFault"
+
+	// ErrCodeSubnetInUse for service response error code
+	// "SubnetInUse".
+	//
+	// The requested subnet is being used by another cache subnet group.
+	ErrCodeSubnetInUse = "SubnetInUse"
+
+	// ErrCodeSubnetNotAllowedFault for service response error code
+	// "SubnetNotAllowedFault".
+	//
+	// At least one subnet ID does not match the other subnet IDs. This mismatch
+	// typically occurs when a user sets one subnet ID to a regional Availability
+	// Zone and a different one to an outpost. Or when a user sets the subnet ID
+	// to an Outpost when not subscribed on this service.
+	ErrCodeSubnetNotAllowedFault = "SubnetNotAllowedFault"
+
+	// ErrCodeTagNotFoundFault for service response error code
+	// "TagNotFound".
+	//
+	// The requested tag was not found on this resource.
+	ErrCodeTagNotFoundFault = "TagNotFound"
+
+	// ErrCodeTagQuotaPerResourceExceeded for service response error code
+	// "TagQuotaPerResourceExceeded".
+	//
+	// The request cannot be processed because it would cause the resource to have
+	// more than the allowed number of tags. The maximum number of tags permitted
+	// on a resource is 50.
+	ErrCodeTagQuotaPerResourceExceeded = "TagQuotaPerResourceExceeded"
+
+	// ErrCodeTestFailoverNotAvailableFault for service response error code
+	// "TestFailoverNotAvailableFault".
+	//
+	// The TestFailover action is not available.
+	ErrCodeTestFailoverNotAvailableFault = "TestFailoverNotAvailableFault"
+
+	// ErrCodeUserAlreadyExistsFault for service response error code
+	// "UserAlreadyExists".
+	//
+	// A user with this ID already exists.
+	ErrCodeUserAlreadyExistsFault = "UserAlreadyExists"
+
+	// ErrCodeUserGroupAlreadyExistsFault for service response error code
+	// "UserGroupAlreadyExists".
+	//
+	// The user group with this ID already exists.
+	ErrCodeUserGroupAlreadyExistsFault = "UserGroupAlreadyExists"
+
+	// ErrCodeUserGroupNotFoundFault for service response error code
+	// "UserGroupNotFound".
+	//
+	// The user group was not found or does not exist
+	ErrCodeUserGroupNotFoundFault = "UserGroupNotFound"
+
+	// ErrCodeUserGroupQuotaExceededFault for service response error code
+	// "UserGroupQuotaExceeded".
+	//
+	// The number of users exceeds the user group limit.
+	ErrCodeUserGroupQuotaExceededFault = "UserGroupQuotaExceeded"
+
+	// ErrCodeUserNotFoundFault for service response error code
+	// "UserNotFound".
+	//
+	// The user does not exist or could not be found.
+	ErrCodeUserNotFoundFault = "UserNotFound"
+
+	// ErrCodeUserQuotaExceededFault for service response error code
+	// "UserQuotaExceeded".
+	//
+	// The quota of users has been exceeded.
+	ErrCodeUserQuotaExceededFault = "UserQuotaExceeded"
+)

vendor/github.com/aws/aws-sdk-go/service/elasticache/service.go

@@ -0,0 +1,98 @@
+// Code generated by private/model/cli/gen-api/main.go. DO NOT EDIT.
+
+package elasticache
+
+import (
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/client"
+	"github.com/aws/aws-sdk-go/aws/client/metadata"
+	"github.com/aws/aws-sdk-go/aws/request"
+	"github.com/aws/aws-sdk-go/aws/signer/v4"
+	"github.com/aws/aws-sdk-go/private/protocol/query"
+)
+
+// ElastiCache provides the API operation methods for making requests to
+// Amazon ElastiCache. See this package's package overview docs
+// for details on the service.
+//
+// ElastiCache methods are safe to use concurrently. It is not safe to
+// modify mutate any of the struct's properties though.
+type ElastiCache struct {
+	*client.Client
+}
+
+// Used for custom client initialization logic
+var initClient func(*client.Client)
+
+// Used for custom request initialization logic
+var initRequest func(*request.Request)
+
+// Service information constants
+const (
+	ServiceName = "elasticache" // Name of service.
+	EndpointsID = ServiceName   // ID to lookup a service endpoint with.
+	ServiceID   = "ElastiCache" // ServiceID is a unique identifier of a specific service.
+)
+
+// New creates a new instance of the ElastiCache client with a session.
+// If additional configuration is needed for the client instance use the optional
+// aws.Config parameter to add your extra config.
+//
+// Example:
+//     mySession := session.Must(session.NewSession())
+//
+//     // Create a ElastiCache client from just a session.
+//     svc := elasticache.New(mySession)
+//
+//     // Create a ElastiCache client with additional configuration
+//     svc := elasticache.New(mySession, aws.NewConfig().WithRegion("us-west-2"))
+func New(p client.ConfigProvider, cfgs ...*aws.Config) *ElastiCache {
+	c := p.ClientConfig(EndpointsID, cfgs...)
+	return newClient(*c.Config, c.Handlers, c.PartitionID, c.Endpoint, c.SigningRegion, c.SigningName)
+}
+
+// newClient creates, initializes and returns a new service client instance.
+func newClient(cfg aws.Config, handlers request.Handlers, partitionID, endpoint, signingRegion, signingName string) *ElastiCache {
+	svc := &ElastiCache{
+		Client: client.New(
+			cfg,
+			metadata.ClientInfo{
+				ServiceName:   ServiceName,
+				ServiceID:     ServiceID,
+				SigningName:   signingName,
+				SigningRegion: signingRegion,
+				PartitionID:   partitionID,
+				Endpoint:      endpoint,
+				APIVersion:    "2015-02-02",
+			},
+			handlers,
+		),
+	}
+
+	// Handlers
+	svc.Handlers.Sign.PushBackNamed(v4.SignRequestHandler)
+	svc.Handlers.Build.PushBackNamed(query.BuildHandler)
+	svc.Handlers.Unmarshal.PushBackNamed(query.UnmarshalHandler)
+	svc.Handlers.UnmarshalMeta.PushBackNamed(query.UnmarshalMetaHandler)
+	svc.Handlers.UnmarshalError.PushBackNamed(query.UnmarshalErrorHandler)
+
+	// Run custom client initialization if present
+	if initClient != nil {
+		initClient(svc.Client)
+	}
+
+	return svc
+}
+
+// newRequest creates a new request for a ElastiCache operation and runs any
+// custom request initialization.
+func (c *ElastiCache) newRequest(op *request.Operation, params, data interface{}) *request.Request {
+	req := c.NewRequest(op, params, data)
+
+	// Run custom request initialization if present
+	if initRequest != nil {
+		initRequest(req)
+	}
+
+	return req
+}

vendor/github.com/aws/aws-sdk-go/service/elasticache/waiters.go

@@ -0,0 +1,264 @@
+// Code generated by private/model/cli/gen-api/main.go. DO NOT EDIT.
+
+package elasticache
+
+import (
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/request"
+)
+
+// WaitUntilCacheClusterAvailable uses the Amazon ElastiCache API operation
+// DescribeCacheClusters to wait for a condition to be met before returning.
+// If the condition is not met within the max attempt window, an error will
+// be returned.
+func (c *ElastiCache) WaitUntilCacheClusterAvailable(input *DescribeCacheClustersInput) error {
+	return c.WaitUntilCacheClusterAvailableWithContext(aws.BackgroundContext(), input)
+}
+
+// WaitUntilCacheClusterAvailableWithContext is an extended version of WaitUntilCacheClusterAvailable.
+// With the support for passing in a context and options to configure the
+// Waiter and the underlying request options.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *ElastiCache) WaitUntilCacheClusterAvailableWithContext(ctx aws.Context, input *DescribeCacheClustersInput, opts ...request.WaiterOption) error {
+	w := request.Waiter{
+		Name:        "WaitUntilCacheClusterAvailable",
+		MaxAttempts: 40,
+		Delay:       request.ConstantWaiterDelay(15 * time.Second),
+		Acceptors: []request.WaiterAcceptor{
+			{
+				State:   request.SuccessWaiterState,
+				Matcher: request.PathAllWaiterMatch, Argument: "CacheClusters[].CacheClusterStatus",
+				Expected: "available",
+			},
+			{
+				State:   request.FailureWaiterState,
+				Matcher: request.PathAnyWaiterMatch, Argument: "CacheClusters[].CacheClusterStatus",
+				Expected: "deleted",
+			},
+			{
+				State:   request.FailureWaiterState,
+				Matcher: request.PathAnyWaiterMatch, Argument: "CacheClusters[].CacheClusterStatus",
+				Expected: "deleting",
+			},
+			{
+				State:   request.FailureWaiterState,
+				Matcher: request.PathAnyWaiterMatch, Argument: "CacheClusters[].CacheClusterStatus",
+				Expected: "incompatible-network",
+			},
+			{
+				State:   request.FailureWaiterState,
+				Matcher: request.PathAnyWaiterMatch, Argument: "CacheClusters[].CacheClusterStatus",
+				Expected: "restore-failed",
+			},
+		},
+		Logger: c.Config.Logger,
+		NewRequest: func(opts []request.Option) (*request.Request, error) {
+			var inCpy *DescribeCacheClustersInput
+			if input != nil {
+				tmp := *input
+				inCpy = &tmp
+			}
+			req, _ := c.DescribeCacheClustersRequest(inCpy)
+			req.SetContext(ctx)
+			req.ApplyOptions(opts...)
+			return req, nil
+		},
+	}
+	w.ApplyOptions(opts...)
+
+	return w.WaitWithContext(ctx)
+}
+
+// WaitUntilCacheClusterDeleted uses the Amazon ElastiCache API operation
+// DescribeCacheClusters to wait for a condition to be met before returning.
+// If the condition is not met within the max attempt window, an error will
+// be returned.
+func (c *ElastiCache) WaitUntilCacheClusterDeleted(input *DescribeCacheClustersInput) error {
+	return c.WaitUntilCacheClusterDeletedWithContext(aws.BackgroundContext(), input)
+}
+
+// WaitUntilCacheClusterDeletedWithContext is an extended version of WaitUntilCacheClusterDeleted.
+// With the support for passing in a context and options to configure the
+// Waiter and the underlying request options.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *ElastiCache) WaitUntilCacheClusterDeletedWithContext(ctx aws.Context, input *DescribeCacheClustersInput, opts ...request.WaiterOption) error {
+	w := request.Waiter{
+		Name:        "WaitUntilCacheClusterDeleted",
+		MaxAttempts: 40,
+		Delay:       request.ConstantWaiterDelay(15 * time.Second),
+		Acceptors: []request.WaiterAcceptor{
+			{
+				State:   request.SuccessWaiterState,
+				Matcher: request.PathAllWaiterMatch, Argument: "CacheClusters[].CacheClusterStatus",
+				Expected: "deleted",
+			},
+			{
+				State:    request.SuccessWaiterState,
+				Matcher:  request.ErrorWaiterMatch,
+				Expected: "CacheClusterNotFound",
+			},
+			{
+				State:   request.FailureWaiterState,
+				Matcher: request.PathAnyWaiterMatch, Argument: "CacheClusters[].CacheClusterStatus",
+				Expected: "available",
+			},
+			{
+				State:   request.FailureWaiterState,
+				Matcher: request.PathAnyWaiterMatch, Argument: "CacheClusters[].CacheClusterStatus",
+				Expected: "creating",
+			},
+			{
+				State:   request.FailureWaiterState,
+				Matcher: request.PathAnyWaiterMatch, Argument: "CacheClusters[].CacheClusterStatus",
+				Expected: "incompatible-network",
+			},
+			{
+				State:   request.FailureWaiterState,
+				Matcher: request.PathAnyWaiterMatch, Argument: "CacheClusters[].CacheClusterStatus",
+				Expected: "modifying",
+			},
+			{
+				State:   request.FailureWaiterState,
+				Matcher: request.PathAnyWaiterMatch, Argument: "CacheClusters[].CacheClusterStatus",
+				Expected: "restore-failed",
+			},
+			{
+				State:   request.FailureWaiterState,
+				Matcher: request.PathAnyWaiterMatch, Argument: "CacheClusters[].CacheClusterStatus",
+				Expected: "snapshotting",
+			},
+		},
+		Logger: c.Config.Logger,
+		NewRequest: func(opts []request.Option) (*request.Request, error) {
+			var inCpy *DescribeCacheClustersInput
+			if input != nil {
+				tmp := *input
+				inCpy = &tmp
+			}
+			req, _ := c.DescribeCacheClustersRequest(inCpy)
+			req.SetContext(ctx)
+			req.ApplyOptions(opts...)
+			return req, nil
+		},
+	}
+	w.ApplyOptions(opts...)
+
+	return w.WaitWithContext(ctx)
+}
+
+// WaitUntilReplicationGroupAvailable uses the Amazon ElastiCache API operation
+// DescribeReplicationGroups to wait for a condition to be met before returning.
+// If the condition is not met within the max attempt window, an error will
+// be returned.
+func (c *ElastiCache) WaitUntilReplicationGroupAvailable(input *DescribeReplicationGroupsInput) error {
+	return c.WaitUntilReplicationGroupAvailableWithContext(aws.BackgroundContext(), input)
+}
+
+// WaitUntilReplicationGroupAvailableWithContext is an extended version of WaitUntilReplicationGroupAvailable.
+// With the support for passing in a context and options to configure the
+// Waiter and the underlying request options.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *ElastiCache) WaitUntilReplicationGroupAvailableWithContext(ctx aws.Context, input *DescribeReplicationGroupsInput, opts ...request.WaiterOption) error {
+	w := request.Waiter{
+		Name:        "WaitUntilReplicationGroupAvailable",
+		MaxAttempts: 40,
+		Delay:       request.ConstantWaiterDelay(15 * time.Second),
+		Acceptors: []request.WaiterAcceptor{
+			{
+				State:   request.SuccessWaiterState,
+				Matcher: request.PathAllWaiterMatch, Argument: "ReplicationGroups[].Status",
+				Expected: "available",
+			},
+			{
+				State:   request.FailureWaiterState,
+				Matcher: request.PathAnyWaiterMatch, Argument: "ReplicationGroups[].Status",
+				Expected: "deleted",
+			},
+		},
+		Logger: c.Config.Logger,
+		NewRequest: func(opts []request.Option) (*request.Request, error) {
+			var inCpy *DescribeReplicationGroupsInput
+			if input != nil {
+				tmp := *input
+				inCpy = &tmp
+			}
+			req, _ := c.DescribeReplicationGroupsRequest(inCpy)
+			req.SetContext(ctx)
+			req.ApplyOptions(opts...)
+			return req, nil
+		},
+	}
+	w.ApplyOptions(opts...)
+
+	return w.WaitWithContext(ctx)
+}
+
+// WaitUntilReplicationGroupDeleted uses the Amazon ElastiCache API operation
+// DescribeReplicationGroups to wait for a condition to be met before returning.
+// If the condition is not met within the max attempt window, an error will
+// be returned.
+func (c *ElastiCache) WaitUntilReplicationGroupDeleted(input *DescribeReplicationGroupsInput) error {
+	return c.WaitUntilReplicationGroupDeletedWithContext(aws.BackgroundContext(), input)
+}
+
+// WaitUntilReplicationGroupDeletedWithContext is an extended version of WaitUntilReplicationGroupDeleted.
+// With the support for passing in a context and options to configure the
+// Waiter and the underlying request options.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *ElastiCache) WaitUntilReplicationGroupDeletedWithContext(ctx aws.Context, input *DescribeReplicationGroupsInput, opts ...request.WaiterOption) error {
+	w := request.Waiter{
+		Name:        "WaitUntilReplicationGroupDeleted",
+		MaxAttempts: 40,
+		Delay:       request.ConstantWaiterDelay(15 * time.Second),
+		Acceptors: []request.WaiterAcceptor{
+			{
+				State:   request.SuccessWaiterState,
+				Matcher: request.PathAllWaiterMatch, Argument: "ReplicationGroups[].Status",
+				Expected: "deleted",
+			},
+			{
+				State:   request.FailureWaiterState,
+				Matcher: request.PathAnyWaiterMatch, Argument: "ReplicationGroups[].Status",
+				Expected: "available",
+			},
+			{
+				State:    request.SuccessWaiterState,
+				Matcher:  request.ErrorWaiterMatch,
+				Expected: "ReplicationGroupNotFoundFault",
+			},
+		},
+		Logger: c.Config.Logger,
+		NewRequest: func(opts []request.Option) (*request.Request, error) {
+			var inCpy *DescribeReplicationGroupsInput
+			if input != nil {
+				tmp := *input
+				inCpy = &tmp
+			}
+			req, _ := c.DescribeReplicationGroupsRequest(inCpy)
+			req.SetContext(ctx)
+			req.ApplyOptions(opts...)
+			return req, nil
+		},
+	}
+	w.ApplyOptions(opts...)
+
+	return w.WaitWithContext(ctx)
+}

vendor/github.com/aws/aws-sdk-go/service/elbv2/doc.go

@@ -15,16 +15,18 @@
 // the targets.
 //
 // Elastic Load Balancing supports the following types of load balancers: Application
-// Load Balancers, Network Load Balancers, and Classic Load Balancers. This
-// reference covers Application Load Balancers and Network Load Balancers.
+// Load Balancers, Network Load Balancers, Gateway Load Balancers, and Classic
+// Load Balancers. This reference covers the following load balancer types:
 //
-// An Application Load Balancer makes routing and load balancing decisions at
-// the application layer (HTTP/HTTPS). A Network Load Balancer makes routing
-// and load balancing decisions at the transport layer (TCP/TLS). Both Application
-// Load Balancers and Network Load Balancers can route requests to one or more
-// ports on each EC2 instance or container instance in your virtual private
-// cloud (VPC). For more information, see the Elastic Load Balancing User Guide
-// (https://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/).
+//    * Application Load Balancer - Operates at the application layer (layer
+//    7) and supports HTTP and HTTPS.
+//
+//    * Network Load Balancer - Operates at the transport layer (layer 4) and
+//    supports TCP, TLS, and UDP.
+//
+//    * Gateway Load Balancer - Operates at the network layer (layer 3).
+//
+// For more information, see the Elastic Load Balancing User Guide (https://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/).
 //
 // All Elastic Load Balancing operations are idempotent, which means that they
 // complete at most one time. If you repeat an operation, it succeeds.

vendor/github.com/aws/aws-sdk-go/service/elbv2/errors.go

@@ -4,6 +4,12 @@ package elbv2
 
 const (
 
+	// ErrCodeALPNPolicyNotSupportedException for service response error code
+	// "ALPNPolicyNotFound".
+	//
+	// The specified ALPN policy is not supported.
+	ErrCodeALPNPolicyNotSupportedException = "ALPNPolicyNotFound"
+
 	// ErrCodeAllocationIdNotFoundException for service response error code
 	// "AllocationIdNotFound".
 	//

vendor/github.com/aws/aws-sdk-go/service/iam/doc.go

@@ -3,59 +3,12 @@
 // Package iam provides the client and types for making API
 // requests to AWS Identity and Access Management.
 //
-// AWS Identity and Access Management (IAM) is a web service that you can use
-// to manage users and user permissions under your AWS account. This guide provides
-// descriptions of IAM actions that you can call programmatically. For general
-// information about IAM, see AWS Identity and Access Management (IAM) (http://aws.amazon.com/iam/).
-// For the user guide for IAM, see Using IAM (https://docs.aws.amazon.com/IAM/latest/UserGuide/).
-//
-// AWS provides SDKs that consist of libraries and sample code for various programming
-// languages and platforms (Java, Ruby, .NET, iOS, Android, etc.). The SDKs
-// provide a convenient way to create programmatic access to IAM and AWS. For
-// example, the SDKs take care of tasks such as cryptographically signing requests
-// (see below), managing errors, and retrying requests automatically. For information
-// about the AWS SDKs, including how to download and install them, see the Tools
-// for Amazon Web Services (http://aws.amazon.com/tools/) page.
-//
-// We recommend that you use the AWS SDKs to make programmatic API calls to
-// IAM. However, you can also use the IAM Query API to make direct calls to
-// the IAM web service. To learn more about the IAM Query API, see Making Query
-// Requests (https://docs.aws.amazon.com/IAM/latest/UserGuide/IAM_UsingQueryAPI.html)
-// in the Using IAM guide. IAM supports GET and POST requests for all actions.
-// That is, the API does not require you to use GET for some actions and POST
-// for others. However, GET requests are subject to the limitation size of a
-// URL. Therefore, for operations that require larger sizes, use a POST request.
-//
-// Signing Requests
-//
-// Requests must be signed using an access key ID and a secret access key. We
-// strongly recommend that you do not use your AWS account access key ID and
-// secret access key for everyday work with IAM. You can use the access key
-// ID and secret access key for an IAM user or you can use the AWS Security
-// Token Service to generate temporary security credentials and use those to
-// sign requests.
-//
-// To sign requests, we recommend that you use Signature Version 4 (https://docs.aws.amazon.com/general/latest/gr/signature-version-4.html).
-// If you have an existing application that uses Signature Version 2, you do
-// not have to update it to use Signature Version 4. However, some operations
-// now require Signature Version 4. The documentation for operations that require
-// version 4 indicate this requirement.
-//
-// Additional Resources
-//
-// For more information, see the following:
-//
-//    * AWS Security Credentials (https://docs.aws.amazon.com/general/latest/gr/aws-security-credentials.html).
-//    This topic provides general information about the types of credentials
-//    used for accessing AWS.
-//
-//    * IAM Best Practices (https://docs.aws.amazon.com/IAM/latest/UserGuide/IAMBestPractices.html).
-//    This topic presents a list of suggestions for using the IAM service to
-//    help secure your AWS resources.
-//
-//    * Signing AWS API Requests (https://docs.aws.amazon.com/general/latest/gr/signing_aws_api_requests.html).
-//    This set of topics walk you through the process of signing a request using
-//    an access key ID and secret access key.
+// AWS Identity and Access Management (IAM) is a web service for securely controlling
+// access to AWS services. With IAM, you can centrally manage users, security
+// credentials such as access keys, and permissions that control which AWS resources
+// users and applications can access. For more information about IAM, see AWS
+// Identity and Access Management (IAM) (http://aws.amazon.com/iam/) and the
+// AWS Identity and Access Management User Guide (https://docs.aws.amazon.com/IAM/latest/UserGuide/).
 //
 // See https://docs.aws.amazon.com/goto/WebAPI/iam-2010-05-08 for more information on this service.
 //

vendor/github.com/aws/aws-sdk-go/service/iam/errors.go

@@ -117,7 +117,8 @@ const (
 	// "LimitExceeded".
 	//
 	// The request was rejected because it attempted to create resources beyond
-	// the current AWS account limits. The error message describes the limit exceeded.
+	// the current AWS account limitations. The error message describes the limit
+	// exceeded.
 	ErrCodeLimitExceededException = "LimitExceeded"
 
 	// ErrCodeMalformedCertificateException for service response error code

vendor/github.com/aws/aws-sdk-go/service/resourcegroupstaggingapi/api.go

@@ -58,8 +58,8 @@ func (c *ResourceGroupsTaggingAPI) DescribeReportCreationRequest(input *Describe
 //
 // Describes the status of the StartReportCreation operation.
 //
-// You can call this operation only from the organization's master account and
-// from the us-east-1 Region.
+// You can call this operation only from the organization's management account
+// and from the us-east-1 Region.
 //
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
 // with awserr.Error's Code and Message methods to get detailed information about
@@ -184,11 +184,18 @@ func (c *ResourceGroupsTaggingAPI) GetComplianceSummaryRequest(input *GetComplia
 // Returns a table that shows counts of resources that are noncompliant with
 // their tag policies.
 //
-// For more information on tag policies, see Tag Policies (http://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_tag-policies.html)
+// For more information on tag policies, see Tag Policies (https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_tag-policies.html)
 // in the AWS Organizations User Guide.
 //
-// You can call this operation only from the organization's master account and
-// from the us-east-1 Region.
+// You can call this operation only from the organization's management account
+// and from the us-east-1 Region.
+//
+// This operation supports pagination, where the response can be sent in multiple
+// pages. You should check the PaginationToken response parameter to determine
+// if there are additional results available to return. Repeat the query, passing
+// the PaginationToken response parameter value as an input to the next request
+// until you recieve a null value. A null value for PaginationToken indicates
+// that there are no more results waiting to be returned.
 //
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
 // with awserr.Error's Code and Message methods to get detailed information about
@@ -373,13 +380,15 @@ func (c *ResourceGroupsTaggingAPI) GetResourcesRequest(input *GetResourcesInput)
 //    resources.
 //
 //    * Information about compliance with the account's effective tag policy.
-//    For more information on tag policies, see Tag Policies (http://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_tag-policies.html)
+//    For more information on tag policies, see Tag Policies (https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_tag-policies.html)
 //    in the AWS Organizations User Guide.
 //
-// You can check the PaginationToken response parameter to determine if a query
-// is complete. Queries occasionally return fewer results on a page than allowed.
-// The PaginationToken response parameter value is null only when there are
-// no more results to display.
+// This operation supports pagination, where the response can be sent in multiple
+// pages. You should check the PaginationToken response parameter to determine
+// if there are additional results available to return. Repeat the query, passing
+// the PaginationToken response parameter value as an input to the next request
+// until you recieve a null value. A null value for PaginationToken indicates
+// that there are no more results waiting to be returned.
 //
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
 // with awserr.Error's Code and Message methods to get detailed information about
@@ -540,7 +549,15 @@ func (c *ResourceGroupsTaggingAPI) GetTagKeysRequest(input *GetTagKeysInput) (re
 
 // GetTagKeys API operation for AWS Resource Groups Tagging API.
 //
-// Returns all tag keys in the specified Region for the AWS account.
+// Returns all tag keys currently in use in the specified Region for the calling
+// AWS account.
+//
+// This operation supports pagination, where the response can be sent in multiple
+// pages. You should check the PaginationToken response parameter to determine
+// if there are additional results available to return. Repeat the query, passing
+// the PaginationToken response parameter value as an input to the next request
+// until you recieve a null value. A null value for PaginationToken indicates
+// that there are no more results waiting to be returned.
 //
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
 // with awserr.Error's Code and Message methods to get detailed information about
@@ -701,8 +718,15 @@ func (c *ResourceGroupsTaggingAPI) GetTagValuesRequest(input *GetTagValuesInput)
 
 // GetTagValues API operation for AWS Resource Groups Tagging API.
 //
-// Returns all tag values for the specified key in the specified Region for
-// the AWS account.
+// Returns all tag values for the specified key that are used in the specified
+// AWS Region for the calling AWS account.
+//
+// This operation supports pagination, where the response can be sent in multiple
+// pages. You should check the PaginationToken response parameter to determine
+// if there are additional results available to return. Repeat the query, passing
+// the PaginationToken response parameter value as an input to the next request
+// until you recieve a null value. A null value for PaginationToken indicates
+// that there are no more results waiting to be returned.
 //
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
 // with awserr.Error's Code and Message methods to get detailed information about
@@ -858,16 +882,16 @@ func (c *ResourceGroupsTaggingAPI) StartReportCreationRequest(input *StartReport
 
 // StartReportCreation API operation for AWS Resource Groups Tagging API.
 //
-// Generates a report that lists all tagged resources in accounts across your
-// organization and tells whether each resource is compliant with the effective
-// tag policy. Compliance data is refreshed daily.
+// Generates a report that lists all tagged resources in the accounts across
+// your organization and tells whether each resource is compliant with the effective
+// tag policy. Compliance data is refreshed daily. The report is generated asynchronously.
 //
 // The generated report is saved to the following location:
 //
 // s3://example-bucket/AwsTagPolicies/o-exampleorgid/YYYY-MM-ddTHH:mm:ssZ/report.csv
 //
-// You can call this operation only from the organization's master account and
-// from the us-east-1 Region.
+// You can call this operation only from the organization's management account
+// and from the us-east-1 Region.
 //
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
 // with awserr.Error's Code and Message methods to get detailed information about
@@ -989,19 +1013,25 @@ func (c *ResourceGroupsTaggingAPI) TagResourcesRequest(input *TagResourcesInput)
 //
 // Applies one or more tags to the specified resources. Note the following:
 //
-//    * Not all resources can have tags. For a list of services that support
-//    tagging, see this list (http://docs.aws.amazon.com/resourcegroupstagging/latest/APIReference/Welcome.html).
+//    * Not all resources can have tags. For a list of services with resources
+//    that support tagging using this operation, see Services that support the
+//    Resource Groups Tagging API (https://docs.aws.amazon.com/resourcegroupstagging/latest/APIReference/supported-services.html).
 //
 //    * Each resource can have up to 50 tags. For other limits, see Tag Naming
-//    and Usage Conventions (http://docs.aws.amazon.com/general/latest/gr/aws_tagging.html#tag-conventions)
+//    and Usage Conventions (https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html#tag-conventions)
 //    in the AWS General Reference.
 //
-//    * You can only tag resources that are located in the specified Region
+//    * You can only tag resources that are located in the specified AWS Region
 //    for the AWS account.
 //
 //    * To add tags to a resource, you need the necessary permissions for the
 //    service that the resource belongs to as well as permissions for adding
-//    tags. For more information, see this list (http://docs.aws.amazon.com/resourcegroupstagging/latest/APIReference/Welcome.html).
+//    tags. For more information, see the documentation for each service.
+//
+// Do not store personally identifiable information (PII) or other confidential
+// or sensitive information in tags. We use tags to provide you with billing
+// and administration services. Tags are not intended to be used for private
+// or sensitive data.
 //
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
 // with awserr.Error's Code and Message methods to get detailed information about
@@ -1107,10 +1137,11 @@ func (c *ResourceGroupsTaggingAPI) UntagResourcesRequest(input *UntagResourcesIn
 //
 //    * To remove tags from a resource, you need the necessary permissions for
 //    the service that the resource belongs to as well as permissions for removing
-//    tags. For more information, see this list (http://docs.aws.amazon.com/resourcegroupstagging/latest/APIReference/Welcome.html).
+//    tags. For more information, see the documentation for the service whose
+//    resource you want to untag.
 //
-//    * You can only tag resources that are located in the specified Region
-//    for the AWS account.
+//    * You can only tag resources that are located in the specified AWS Region
+//    for the calling AWS account.
 //
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
 // with awserr.Error's Code and Message methods to get detailed information about
@@ -1472,52 +1503,58 @@ func (s *FailureInfo) SetStatusCode(v int64) *FailureInfo {
 type GetComplianceSummaryInput struct {
 	_ struct{} `type:"structure"`
 
-	// A list of attributes to group the counts of noncompliant resources by. If
-	// supplied, the counts are sorted by those attributes.
+	// Specifies a list of attributes to group the counts of noncompliant resources
+	// by. If supplied, the counts are sorted by those attributes.
 	GroupBy []*string `type:"list"`
 
-	// A limit that restricts the number of results that are returned per page.
+	// Specifies the maximum number of results to be returned in each page. A query
+	// can return fewer than this maximum, even if there are more results still
+	// to return. You should always check the PaginationToken response value to
+	// see if there are more results. You can specify a minimum of 1 and a maximum
+	// value of 100.
 	MaxResults *int64 `min:"1" type:"integer"`
 
-	// A string that indicates that additional data is available. Leave this value
-	// empty for your initial request. If the response includes a PaginationToken,
-	// use that string for this value to request an additional page of data.
+	// Specifies a PaginationToken response value from a previous request to indicate
+	// that you want the next page of results. Leave this parameter empty in your
+	// initial request.
 	PaginationToken *string `type:"string"`
 
-	// A list of Regions to limit the output by. If you use this parameter, the
-	// count of returned noncompliant resources includes only resources in the specified
-	// Regions.
+	// Specifies a list of AWS Regions to limit the output by. If you use this parameter,
+	// the count of returned noncompliant resources includes only resources in the
+	// specified Regions.
 	RegionFilters []*string `min:"1" type:"list"`
 
-	// The constraints on the resources that you want returned. The format of each
-	// resource type is service[:resourceType]. For example, specifying a resource
-	// type of ec2 returns all Amazon EC2 resources (which includes EC2 instances).
-	// Specifying a resource type of ec2:instance returns only EC2 instances.
+	// Specifies that you want the response to include information for only resources
+	// of the specified types. The format of each resource type is service[:resourceType].
+	// For example, specifying a resource type of ec2 returns all Amazon EC2 resources
+	// (which includes EC2 instances). Specifying a resource type of ec2:instance
+	// returns only EC2 instances.
 	//
 	// The string for each service name and resource type is the same as that embedded
 	// in a resource's Amazon Resource Name (ARN). Consult the AWS General Reference
 	// for the following:
 	//
-	//    * For a list of service name strings, see AWS Service Namespaces (http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#genref-aws-service-namespaces).
+	//    * For a list of service name strings, see AWS Service Namespaces (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#genref-aws-service-namespaces).
 	//
-	//    * For resource type strings, see Example ARNs (http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arns-syntax).
+	//    * For resource type strings, see Example ARNs (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arns-syntax).
 	//
 	//    * For more information about ARNs, see Amazon Resource Names (ARNs) and
-	//    AWS Service Namespaces (http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html).
+	//    AWS Service Namespaces (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html).
 	//
-	// You can specify multiple resource types by using an array. The array can
-	// include up to 100 items. Note that the length constraint requirement applies
-	// to each resource type filter.
+	// You can specify multiple resource types by using a comma separated array.
+	// The array can include up to 100 items. Note that the length constraint requirement
+	// applies to each resource type filter.
 	ResourceTypeFilters []*string `type:"list"`
 
-	// A list of tag keys to limit the output by. If you use this parameter, the
+	// Specifies that you want the response to include information for only resources
+	// that have tags with the specified tag keys. If you use this parameter, the
 	// count of returned noncompliant resources includes only resources that have
 	// the specified tag keys.
 	TagKeyFilters []*string `min:"1" type:"list"`
 
-	// The target identifiers (usually, specific account IDs) to limit the output
-	// by. If you use this parameter, the count of returned noncompliant resources
-	// includes only resources with the specified target IDs.
+	// Specifies target identifiers (usually, specific account IDs) to limit the
+	// output by. If you use this parameter, the count of returned noncompliant
+	// resources includes only resources with the specified target IDs.
 	TargetIdFilters []*string `min:"1" type:"list"`
 }
 
@@ -1598,9 +1635,9 @@ func (s *GetComplianceSummaryInput) SetTargetIdFilters(v []*string) *GetComplian
 type GetComplianceSummaryOutput struct {
 	_ struct{} `type:"structure"`
 
-	// A string that indicates that the response contains more data than can be
-	// returned in a single response. To receive additional data, specify this string
-	// for the PaginationToken value in a subsequent request.
+	// A string that indicates that there is more data available than this response
+	// contains. To receive the next part of the response, specify this response
+	// value as the PaginationToken value in the request for the next page.
 	PaginationToken *string `type:"string"`
 
 	// A table that shows counts of noncompliant resources.
@@ -1645,67 +1682,75 @@ type GetResourcesInput struct {
 	// with the tag policy and to get details.
 	IncludeComplianceDetails *bool `type:"boolean"`
 
-	// A string that indicates that additional data is available. Leave this value
-	// empty for your initial request. If the response includes a PaginationToken,
-	// use that string for this value to request an additional page of data.
+	// Specifies a PaginationToken response value from a previous request to indicate
+	// that you want the next page of results. Leave this parameter empty in your
+	// initial request.
 	PaginationToken *string `type:"string"`
 
-	// The constraints on the resources that you want returned. The format of each
-	// resource type is service[:resourceType]. For example, specifying a resource
-	// type of ec2 returns all Amazon EC2 resources (which includes EC2 instances).
-	// Specifying a resource type of ec2:instance returns only EC2 instances.
+	// Specifies a list of ARNs of resources for which you want to retrieve tag
+	// data. You can't specify both this parameter and any of the pagination parameters
+	// (ResourcesPerPage, TagsPerPage, PaginationToken) in the same request. If
+	// you specify both, you get an Invalid Parameter exception.
+	//
+	// If a resource specified by this parameter doesn't exist, it doesn't generate
+	// an error; it simply isn't included in the response.
+	//
+	// An ARN (Amazon Resource Name) uniquely identifies a resource. For more information,
+	// see Amazon Resource Names (ARNs) and AWS Service Namespaces (http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html)
+	// in the AWS General Reference.
+	ResourceARNList []*string `min:"1" type:"list"`
+
+	// Specifies the resource types that you want included in the response. The
+	// format of each resource type is service[:resourceType]. For example, specifying
+	// a resource type of ec2 returns all Amazon EC2 resources (which includes EC2
+	// instances). Specifying a resource type of ec2:instance returns only EC2 instances.
 	//
 	// The string for each service name and resource type is the same as that embedded
 	// in a resource's Amazon Resource Name (ARN). Consult the AWS General Reference
 	// for the following:
 	//
-	//    * For a list of service name strings, see AWS Service Namespaces (http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#genref-aws-service-namespaces).
-	//
-	//    * For resource type strings, see Example ARNs (http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arns-syntax).
-	//
-	//    * For more information about ARNs, see Amazon Resource Names (ARNs) and
-	//    AWS Service Namespaces (http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html).
+	// For more information about ARNs, see Amazon Resource Names (ARNs) and AWS
+	// Service Namespaces (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html).
 	//
 	// You can specify multiple resource types by using an array. The array can
 	// include up to 100 items. Note that the length constraint requirement applies
 	// to each resource type filter.
 	ResourceTypeFilters []*string `type:"list"`
 
-	// A limit that restricts the number of resources returned by GetResources in
-	// paginated output. You can set ResourcesPerPage to a minimum of 1 item and
-	// the maximum of 100 items.
+	// Specifies the maximum number of results to be returned in each page. A query
+	// can return fewer than this maximum, even if there are more results still
+	// to return. You should always check the PaginationToken response value to
+	// see if there are more results. You can specify a minimum of 1 and a maximum
+	// value of 100.
 	ResourcesPerPage *int64 `type:"integer"`
 
-	// A list of TagFilters (keys and values). Each TagFilter specified must contain
-	// a key with values as optional. A request can include up to 50 keys, and each
-	// key can include up to 20 values.
+	// Specifies a list of TagFilters (keys and values) to restrict the output to
+	// only those resources that have the specified tag and, if included, the specified
+	// value. Each TagFilter must contain a key with values optional. A request
+	// can include up to 50 keys, and each key can include up to 20 values.
 	//
 	// Note the following when deciding how to use TagFilters:
 	//
-	//    * If you do specify a TagFilter, the response returns only those resources
-	//    that are currently associated with the specified tag.
-	//
 	//    * If you don't specify a TagFilter, the response includes all resources
-	//    that were ever associated with tags. Resources that currently don't have
-	//    associated tags are shown with an empty tag set, like this: "Tags": [].
+	//    that are currently tagged or ever had a tag. Resources that currently
+	//    don't have tags are shown with an empty tag set, like this: "Tags": [].
 	//
 	//    * If you specify more than one filter in a single request, the response
-	//    returns only those resources that satisfy all specified filters.
+	//    returns only those resources that satisfy all filters.
 	//
 	//    * If you specify a filter that contains more than one value for a key,
 	//    the response returns resources that match any of the specified values
 	//    for that key.
 	//
 	//    * If you don't specify any values for a key, the response returns resources
-	//    that are tagged with that key irrespective of the value. For example,
-	//    for filters: filter1 = {key1, {value1}}, filter2 = {key2, {value2,value3,value4}}
-	//    , filter3 = {key3}: GetResources( {filter1} ) returns resources tagged
-	//    with key1=value1 GetResources( {filter2} ) returns resources tagged with
-	//    key2=value2 or key2=value3 or key2=value4 GetResources( {filter3} ) returns
-	//    resources tagged with any tag containing key3 as its tag key, irrespective
-	//    of its value GetResources( {filter1,filter2,filter3} ) returns resources
-	//    tagged with ( key1=value1) and ( key2=value2 or key2=value3 or key2=value4)
-	//    and (key3, irrespective of the value)
+	//    that are tagged with that key and any or no value. For example, for the
+	//    following filters: filter1= {keyA,{value1}}, filter2={keyB,{value2,value3,value4}},
+	//    filter3= {keyC}: GetResources({filter1}) returns resources tagged with
+	//    key1=value1 GetResources({filter2}) returns resources tagged with key2=value2
+	//    or key2=value3 or key2=value4 GetResources({filter3}) returns resources
+	//    tagged with any tag with the key key3, and with any or no value GetResources({filter1,filter2,filter3})
+	//    returns resources tagged with (key1=value1) and (key2=value2 or key2=value3
+	//    or key2=value4) and (key3, any or no value)
 	TagFilters []*TagFilter `type:"list"`
 
 	// AWS recommends using ResourcesPerPage instead of this parameter.
@@ -1725,7 +1770,7 @@ type GetResourcesInput struct {
 	// tags. The third page displays the remaining 2 resources, each with its 10
 	// tags.
 	//
-	// You can set TagsPerPage to a minimum of 100 items and the maximum of 500
+	// You can set TagsPerPage to a minimum of 100 items up to a maximum of 500
 	// items.
 	TagsPerPage *int64 `type:"integer"`
 }
@@ -1743,6 +1788,9 @@ func (s GetResourcesInput) GoString() string {
 // Validate inspects the fields of the type to determine if they are valid.
 func (s *GetResourcesInput) Validate() error {
 	invalidParams := request.ErrInvalidParams{Context: "GetResourcesInput"}
+	if s.ResourceARNList != nil && len(s.ResourceARNList) < 1 {
+		invalidParams.Add(request.NewErrParamMinLen("ResourceARNList", 1))
+	}
 	if s.TagFilters != nil {
 		for i, v := range s.TagFilters {
 			if v == nil {
@@ -1778,6 +1826,12 @@ func (s *GetResourcesInput) SetPaginationToken(v string) *GetResourcesInput {
 	return s
 }
 
+// SetResourceARNList sets the ResourceARNList field's value.
+func (s *GetResourcesInput) SetResourceARNList(v []*string) *GetResourcesInput {
+	s.ResourceARNList = v
+	return s
+}
+
 // SetResourceTypeFilters sets the ResourceTypeFilters field's value.
 func (s *GetResourcesInput) SetResourceTypeFilters(v []*string) *GetResourcesInput {
 	s.ResourceTypeFilters = v
@@ -1805,12 +1859,13 @@ func (s *GetResourcesInput) SetTagsPerPage(v int64) *GetResourcesInput {
 type GetResourcesOutput struct {
 	_ struct{} `type:"structure"`
 
-	// A string that indicates that the response contains more data than can be
-	// returned in a single response. To receive additional data, specify this string
-	// for the PaginationToken value in a subsequent request.
+	// A string that indicates that there is more data available than this response
+	// contains. To receive the next part of the response, specify this response
+	// value as the PaginationToken value in the request for the next page.
 	PaginationToken *string `type:"string"`
 
-	// A list of resource ARNs and the tags (keys and values) associated with each.
+	// A list of resource ARNs and the tags (keys and values) associated with those
+	// ARNs.
 	ResourceTagMappingList []*ResourceTagMapping `type:"list"`
 }
 
@@ -1839,9 +1894,9 @@ func (s *GetResourcesOutput) SetResourceTagMappingList(v []*ResourceTagMapping)
 type GetTagKeysInput struct {
 	_ struct{} `type:"structure"`
 
-	// A string that indicates that additional data is available. Leave this value
-	// empty for your initial request. If the response includes a PaginationToken,
-	// use that string for this value to request an additional page of data.
+	// Specifies a PaginationToken response value from a previous request to indicate
+	// that you want the next page of results. Leave this parameter empty in your
+	// initial request.
 	PaginationToken *string `type:"string"`
 }
 
@@ -1864,9 +1919,9 @@ func (s *GetTagKeysInput) SetPaginationToken(v string) *GetTagKeysInput {
 type GetTagKeysOutput struct {
 	_ struct{} `type:"structure"`
 
-	// A string that indicates that the response contains more data than can be
-	// returned in a single response. To receive additional data, specify this string
-	// for the PaginationToken value in a subsequent request.
+	// A string that indicates that there is more data available than this response
+	// contains. To receive the next part of the response, specify this response
+	// value as the PaginationToken value in the request for the next page.
 	PaginationToken *string `type:"string"`
 
 	// A list of all tag keys in the AWS account.
@@ -1898,15 +1953,15 @@ func (s *GetTagKeysOutput) SetTagKeys(v []*string) *GetTagKeysOutput {
 type GetTagValuesInput struct {
 	_ struct{} `type:"structure"`
 
-	// The key for which you want to list all existing values in the specified Region
-	// for the AWS account.
+	// Specifies the tag key for which you want to list all existing values that
+	// are currently used in the specified AWS Region for the calling AWS account.
 	//
 	// Key is a required field
 	Key *string `min:"1" type:"string" required:"true"`
 
-	// A string that indicates that additional data is available. Leave this value
-	// empty for your initial request. If the response includes a PaginationToken,
-	// use that string for this value to request an additional page of data.
+	// Specifies a PaginationToken response value from a previous request to indicate
+	// that you want the next page of results. Leave this parameter empty in your
+	// initial request.
 	PaginationToken *string `type:"string"`
 }
 
@@ -1951,12 +2006,13 @@ func (s *GetTagValuesInput) SetPaginationToken(v string) *GetTagValuesInput {
 type GetTagValuesOutput struct {
 	_ struct{} `type:"structure"`
 
-	// A string that indicates that the response contains more data than can be
-	// returned in a single response. To receive additional data, specify this string
-	// for the PaginationToken value in a subsequent request.
+	// A string that indicates that there is more data available than this response
+	// contains. To receive the next part of the response, specify this response
+	// value as the PaginationToken value in the request for the next page.
 	PaginationToken *string `type:"string"`
 
-	// A list of all tag values for the specified key in the AWS account.
+	// A list of all tag values for the specified key currently used in the specified
+	// AWS Region for the calling AWS account.
 	TagValues []*string `type:"list"`
 }
 
@@ -2434,16 +2490,17 @@ func (s *TagFilter) SetValues(v []*string) *TagFilter {
 type TagResourcesInput struct {
 	_ struct{} `type:"structure"`
 
-	// A list of ARNs. An ARN (Amazon Resource Name) uniquely identifies a resource.
-	// For more information, see Amazon Resource Names (ARNs) and AWS Service Namespaces
-	// (http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html)
+	// Specifies the list of ARNs of the resources that you want to apply tags to.
+	//
+	// An ARN (Amazon Resource Name) uniquely identifies a resource. For more information,
+	// see Amazon Resource Names (ARNs) and AWS Service Namespaces (http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html)
 	// in the AWS General Reference.
 	//
 	// ResourceARNList is a required field
 	ResourceARNList []*string `min:"1" type:"list" required:"true"`
 
-	// The tags that you want to add to the specified resources. A tag consists
-	// of a key and a value that you define.
+	// Specifies a list of tags that you want to add to the specified resources.
+	// A tag consists of a key and a value that you define.
 	//
 	// Tags is a required field
 	Tags map[string]*string `min:"1" type:"map" required:"true"`
@@ -2578,15 +2635,16 @@ func (s *ThrottledException) RequestID() string {
 type UntagResourcesInput struct {
 	_ struct{} `type:"structure"`
 
-	// A list of ARNs. An ARN (Amazon Resource Name) uniquely identifies a resource.
-	// For more information, see Amazon Resource Names (ARNs) and AWS Service Namespaces
-	// (http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html)
+	// Specifies a list of ARNs of the resources that you want to remove tags from.
+	//
+	// An ARN (Amazon Resource Name) uniquely identifies a resource. For more information,
+	// see Amazon Resource Names (ARNs) and AWS Service Namespaces (http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html)
 	// in the AWS General Reference.
 	//
 	// ResourceARNList is a required field
 	ResourceARNList []*string `min:"1" type:"list" required:"true"`
 
-	// A list of the tag keys that you want to remove from the specified resources.
+	// Specifies a list of tag keys that you want to remove from the specified resources.
 	//
 	// TagKeys is a required field
 	TagKeys []*string `min:"1" type:"list" required:"true"`
@@ -2639,8 +2697,10 @@ func (s *UntagResourcesInput) SetTagKeys(v []*string) *UntagResourcesInput {
 type UntagResourcesOutput struct {
 	_ struct{} `type:"structure"`
 
-	// Details of resources that could not be untagged. An error code, status code,
-	// and error message are returned for each failed item.
+	// A map containing a key-value pair for each failed item that couldn't be untagged.
+	// The key is the ARN of the failed resource. The value is a FailureInfo object
+	// that contains an error code, a status code, and an error message. If there
+	// are no errors, the FailedResourcesMap is empty.
 	FailedResourcesMap map[string]*FailureInfo `type:"map"`
 }
 
@@ -2668,6 +2728,14 @@ const (
 	ErrorCodeInvalidParameterException = "InvalidParameterException"
 )
 
+// ErrorCode_Values returns all elements of the ErrorCode enum
+func ErrorCode_Values() []string {
+	return []string{
+		ErrorCodeInternalServiceException,
+		ErrorCodeInvalidParameterException,
+	}
+}
+
 const (
 	// GroupByAttributeTargetId is a GroupByAttribute enum value
 	GroupByAttributeTargetId = "TARGET_ID"
@@ -2679,6 +2747,15 @@ const (
 	GroupByAttributeResourceType = "RESOURCE_TYPE"
 )
 
+// GroupByAttribute_Values returns all elements of the GroupByAttribute enum
+func GroupByAttribute_Values() []string {
+	return []string{
+		GroupByAttributeTargetId,
+		GroupByAttributeRegion,
+		GroupByAttributeResourceType,
+	}
+}
+
 const (
 	// TargetIdTypeAccount is a TargetIdType enum value
 	TargetIdTypeAccount = "ACCOUNT"
@@ -2689,3 +2766,12 @@ const (
 	// TargetIdTypeRoot is a TargetIdType enum value
 	TargetIdTypeRoot = "ROOT"
 )
+
+// TargetIdType_Values returns all elements of the TargetIdType enum
+func TargetIdType_Values() []string {
+	return []string{
+		TargetIdTypeAccount,
+		TargetIdTypeOu,
+		TargetIdTypeRoot,
+	}
+}

vendor/github.com/aws/aws-sdk-go/service/resourcegroupstaggingapi/doc.go

@@ -3,245 +3,7 @@
 // Package resourcegroupstaggingapi provides the client and types for making API
 // requests to AWS Resource Groups Tagging API.
 //
-// This guide describes the API operations for the resource groups tagging.
-//
-// A tag is a label that you assign to an AWS resource. A tag consists of a
-// key and a value, both of which you define. For example, if you have two Amazon
-// EC2 instances, you might assign both a tag key of "Stack." But the value
-// of "Stack" might be "Testing" for one and "Production" for the other.
-//
-// Tagging can help you organize your resources and enables you to simplify
-// resource management, access management and cost allocation.
-//
-// You can use the resource groups tagging API operations to complete the following
-// tasks:
-//
-//    * Tag and untag supported resources located in the specified Region for
-//    the AWS account.
-//
-//    * Use tag-based filters to search for resources located in the specified
-//    Region for the AWS account.
-//
-//    * List all existing tag keys in the specified Region for the AWS account.
-//
-//    * List all existing values for the specified key in the specified Region
-//    for the AWS account.
-//
-// To use resource groups tagging API operations, you must add the following
-// permissions to your IAM policy:
-//
-//    * tag:GetResources
-//
-//    * tag:TagResources
-//
-//    * tag:UntagResources
-//
-//    * tag:GetTagKeys
-//
-//    * tag:GetTagValues
-//
-// You'll also need permissions to access the resources of individual services
-// so that you can tag and untag those resources.
-//
-// For more information on IAM policies, see Managing IAM Policies (http://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage.html)
-// in the IAM User Guide.
-//
-// You can use the Resource Groups Tagging API to tag resources for the following
-// AWS services.
-//
-//    * Alexa for Business (a4b)
-//
-//    * API Gateway
-//
-//    * Amazon AppStream
-//
-//    * AWS AppSync
-//
-//    * AWS App Mesh
-//
-//    * Amazon Athena
-//
-//    * Amazon Aurora
-//
-//    * AWS Backup
-//
-//    * AWS Certificate Manager
-//
-//    * AWS Certificate Manager Private CA
-//
-//    * Amazon Cloud Directory
-//
-//    * AWS CloudFormation
-//
-//    * Amazon CloudFront
-//
-//    * AWS CloudHSM
-//
-//    * AWS CloudTrail
-//
-//    * Amazon CloudWatch (alarms only)
-//
-//    * Amazon CloudWatch Events
-//
-//    * Amazon CloudWatch Logs
-//
-//    * AWS CodeBuild
-//
-//    * AWS CodeCommit
-//
-//    * AWS CodePipeline
-//
-//    * AWS CodeStar
-//
-//    * Amazon Cognito Identity
-//
-//    * Amazon Cognito User Pools
-//
-//    * Amazon Comprehend
-//
-//    * AWS Config
-//
-//    * AWS Data Exchange
-//
-//    * AWS Data Pipeline
-//
-//    * AWS Database Migration Service
-//
-//    * AWS DataSync
-//
-//    * AWS Device Farm
-//
-//    * AWS Direct Connect
-//
-//    * AWS Directory Service
-//
-//    * Amazon DynamoDB
-//
-//    * Amazon EBS
-//
-//    * Amazon EC2
-//
-//    * Amazon ECR
-//
-//    * Amazon ECS
-//
-//    * Amazon EKS
-//
-//    * AWS Elastic Beanstalk
-//
-//    * Amazon Elastic File System
-//
-//    * Elastic Load Balancing
-//
-//    * Amazon ElastiCache
-//
-//    * Amazon Elasticsearch Service
-//
-//    * AWS Elemental MediaLive
-//
-//    * AWS Elemental MediaPackage
-//
-//    * AWS Elemental MediaTailor
-//
-//    * Amazon EMR
-//
-//    * Amazon FSx
-//
-//    * Amazon S3 Glacier
-//
-//    * AWS Glue
-//
-//    * Amazon GuardDuty
-//
-//    * Amazon Inspector
-//
-//    * AWS IoT Analytics
-//
-//    * AWS IoT Core
-//
-//    * AWS IoT Device Defender
-//
-//    * AWS IoT Device Management
-//
-//    * AWS IoT Events
-//
-//    * AWS IoT Greengrass
-//
-//    * AWS IoT 1-Click
-//
-//    * AWS IoT Things Graph
-//
-//    * AWS Key Management Service
-//
-//    * Amazon Kinesis
-//
-//    * Amazon Kinesis Data Analytics
-//
-//    * Amazon Kinesis Data Firehose
-//
-//    * AWS Lambda
-//
-//    * AWS License Manager
-//
-//    * Amazon Machine Learning
-//
-//    * Amazon MQ
-//
-//    * Amazon MSK
-//
-//    * Amazon Neptune
-//
-//    * AWS OpsWorks
-//
-//    * AWS Organizations
-//
-//    * Amazon Quantum Ledger Database (QLDB)
-//
-//    * Amazon RDS
-//
-//    * Amazon Redshift
-//
-//    * AWS Resource Access Manager
-//
-//    * AWS Resource Groups
-//
-//    * AWS RoboMaker
-//
-//    * Amazon Route 53
-//
-//    * Amazon Route 53 Resolver
-//
-//    * Amazon S3 (buckets only)
-//
-//    * Amazon SageMaker
-//
-//    * AWS Secrets Manager
-//
-//    * AWS Security Hub
-//
-//    * AWS Service Catalog
-//
-//    * Amazon Simple Email Service (SES)
-//
-//    * Amazon Simple Notification Service (SNS)
-//
-//    * Amazon Simple Queue Service (SQS)
-//
-//    * Amazon Simple Workflow Service
-//
-//    * AWS Step Functions
-//
-//    * AWS Storage Gateway
-//
-//    * AWS Systems Manager
-//
-//    * AWS Transfer for SFTP
-//
-//    * AWS WAF Regional
-//
-//    * Amazon VPC
-//
-//    * Amazon WorkSpaces
+// Resource Groups Tagging API
 //
 // See https://docs.aws.amazon.com/goto/WebAPI/resourcegroupstaggingapi-2017-01-26 for more information on this service.
 //

vendor/github.com/aws/aws-sdk-go/service/route53/errors.go

@@ -40,6 +40,12 @@ const (
 	// specified the type in the JSON document in the CreateTrafficPolicy or CreateTrafficPolicyVersionrequest.
 	ErrCodeConflictingTypes = "ConflictingTypes"
 
+	// ErrCodeDNSSECNotFound for service response error code
+	// "DNSSECNotFound".
+	//
+	// The hosted zone doesn't have any DNSSEC resources.
+	ErrCodeDNSSECNotFound = "DNSSECNotFound"
+
 	// ErrCodeDelegationSetAlreadyCreated for service response error code
 	// "DelegationSetAlreadyCreated".
 	//
@@ -129,6 +135,13 @@ const (
 	// The specified hosted zone is a public hosted zone, not a private hosted zone.
 	ErrCodeHostedZoneNotPrivate = "HostedZoneNotPrivate"
 
+	// ErrCodeHostedZonePartiallyDelegated for service response error code
+	// "HostedZonePartiallyDelegated".
+	//
+	// The hosted zone nameservers don't match the parent nameservers. The hosted
+	// zone and parent must have the same nameservers.
+	ErrCodeHostedZonePartiallyDelegated = "HostedZonePartiallyDelegated"
+
 	// ErrCodeIncompatibleVersion for service response error code
 	// "IncompatibleVersion".
 	//
@@ -154,7 +167,7 @@ const (
 	// ErrCodeInvalidArgument for service response error code
 	// "InvalidArgument".
 	//
-	// Parameter name is invalid.
+	// Parameter name is not valid.
 	ErrCodeInvalidArgument = "InvalidArgument"
 
 	// ErrCodeInvalidChangeBatch for service response error code
@@ -176,6 +189,26 @@ const (
 	// The input is not valid.
 	ErrCodeInvalidInput = "InvalidInput"
 
+	// ErrCodeInvalidKMSArn for service response error code
+	// "InvalidKMSArn".
+	//
+	// The KeyManagementServiceArn that you specified isn't valid to use with DNSSEC
+	// signing.
+	ErrCodeInvalidKMSArn = "InvalidKMSArn"
+
+	// ErrCodeInvalidKeySigningKeyName for service response error code
+	// "InvalidKeySigningKeyName".
+	//
+	// The key signing key (KSK) name that you specified isn't a valid name.
+	ErrCodeInvalidKeySigningKeyName = "InvalidKeySigningKeyName"
+
+	// ErrCodeInvalidKeySigningKeyStatus for service response error code
+	// "InvalidKeySigningKeyStatus".
+	//
+	// The key signing key (KSK) status isn't valid or another KSK has the status
+	// INTERNAL_FAILURE.
+	ErrCodeInvalidKeySigningKeyStatus = "InvalidKeySigningKeyStatus"
+
 	// ErrCodeInvalidPaginationToken for service response error code
 	// "InvalidPaginationToken".
 	//
@@ -183,11 +216,18 @@ const (
 	// is invalid.
 	ErrCodeInvalidPaginationToken = "InvalidPaginationToken"
 
+	// ErrCodeInvalidSigningStatus for service response error code
+	// "InvalidSigningStatus".
+	//
+	// Your hosted zone status isn't valid for this operation. In the hosted zone,
+	// change the status to enable DNSSEC or disable DNSSEC.
+	ErrCodeInvalidSigningStatus = "InvalidSigningStatus"
+
 	// ErrCodeInvalidTrafficPolicyDocument for service response error code
 	// "InvalidTrafficPolicyDocument".
 	//
 	// The format of the traffic policy document that you specified in the Document
-	// element is invalid.
+	// element is not valid.
 	ErrCodeInvalidTrafficPolicyDocument = "InvalidTrafficPolicyDocument"
 
 	// ErrCodeInvalidVPCId for service response error code
@@ -197,6 +237,33 @@ const (
 	// is not authorized to access this VPC.
 	ErrCodeInvalidVPCId = "InvalidVPCId"
 
+	// ErrCodeKeySigningKeyAlreadyExists for service response error code
+	// "KeySigningKeyAlreadyExists".
+	//
+	// You've already created a key signing key (KSK) with this name or with the
+	// same customer managed key (CMK) ARN.
+	ErrCodeKeySigningKeyAlreadyExists = "KeySigningKeyAlreadyExists"
+
+	// ErrCodeKeySigningKeyInParentDSRecord for service response error code
+	// "KeySigningKeyInParentDSRecord".
+	//
+	// The key signing key (KSK) is specified in a parent DS record.
+	ErrCodeKeySigningKeyInParentDSRecord = "KeySigningKeyInParentDSRecord"
+
+	// ErrCodeKeySigningKeyInUse for service response error code
+	// "KeySigningKeyInUse".
+	//
+	// The key signing key (KSK) that you specified can't be deactivated because
+	// it's the only KSK for a currently-enabled DNSSEC. Disable DNSSEC signing,
+	// or add or enable another KSK.
+	ErrCodeKeySigningKeyInUse = "KeySigningKeyInUse"
+
+	// ErrCodeKeySigningKeyWithActiveStatusNotFound for service response error code
+	// "KeySigningKeyWithActiveStatusNotFound".
+	//
+	// A key signing key (KSK) with ACTIVE status wasn't found.
+	ErrCodeKeySigningKeyWithActiveStatusNotFound = "KeySigningKeyWithActiveStatusNotFound"
+
 	// ErrCodeLastVPCAssociation for service response error code
 	// "LastVPCAssociation".
 	//
@@ -257,6 +324,12 @@ const (
 	// No hosted zone exists with the ID that you specified.
 	ErrCodeNoSuchHostedZone = "NoSuchHostedZone"
 
+	// ErrCodeNoSuchKeySigningKey for service response error code
+	// "NoSuchKeySigningKey".
+	//
+	// The specified key signing key (KSK) doesn't exist.
+	ErrCodeNoSuchKeySigningKey = "NoSuchKeySigningKey"
+
 	// ErrCodeNoSuchQueryLoggingConfig for service response error code
 	// "NoSuchQueryLoggingConfig".
 	//
@@ -352,6 +425,13 @@ const (
 	// with the AWS Support Center.
 	ErrCodeTooManyHostedZones = "TooManyHostedZones"
 
+	// ErrCodeTooManyKeySigningKeys for service response error code
+	// "TooManyKeySigningKeys".
+	//
+	// You've reached the limit for the number of key signing keys (KSKs). Remove
+	// at least one KSK, and then try again.
+	ErrCodeTooManyKeySigningKeys = "TooManyKeySigningKeys"
+
 	// ErrCodeTooManyTrafficPolicies for service response error code
 	// "TooManyTrafficPolicies".
 	//

vendor/github.com/aws/aws-sdk-go/service/s3/body_hash.go

@@ -13,7 +13,6 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/awserr"
 	"github.com/aws/aws-sdk-go/aws/request"
-	"github.com/aws/aws-sdk-go/internal/sdkio"
 )
 
 const (
@@ -25,30 +24,6 @@ const (
 	appendMD5TxEncoding = "append-md5"
 )
 
-// contentMD5 computes and sets the HTTP Content-MD5 header for requests that
-// require it.
-func contentMD5(r *request.Request) {
-	h := md5.New()
-
-	if !aws.IsReaderSeekable(r.Body) {
-		if r.Config.Logger != nil {
-			r.Config.Logger.Log(fmt.Sprintf(
-				"Unable to compute Content-MD5 for unseekable body, S3.%s",
-				r.Operation.Name))
-		}
-		return
-	}
-
-	if _, err := copySeekableBody(h, r.Body); err != nil {
-		r.Error = awserr.New("ContentMD5", "failed to compute body MD5", err)
-		return
-	}
-
-	// encode the md5 checksum in base64 and set the request header.
-	v := base64.StdEncoding.EncodeToString(h.Sum(nil))
-	r.HTTPRequest.Header.Set(contentMD5Header, v)
-}
-
 // computeBodyHashes will add Content MD5 and Content Sha256 hashes to the
 // request. If the body is not seekable or S3DisableContentMD5Validation set
 // this handler will be ignored.
@@ -90,7 +65,7 @@ func computeBodyHashes(r *request.Request) {
 		dst = io.MultiWriter(hashers...)
 	}
 
-	if _, err := copySeekableBody(dst, r.Body); err != nil {
+	if _, err := aws.CopySeekableBody(dst, r.Body); err != nil {
 		r.Error = awserr.New("BodyHashError", "failed to compute body hashes", err)
 		return
 	}
@@ -119,28 +94,6 @@ const (
 	sha256HexEncLen = sha256.Size * 2        // hex.EncodedLen
 )
 
-func copySeekableBody(dst io.Writer, src io.ReadSeeker) (int64, error) {
-	curPos, err := src.Seek(0, sdkio.SeekCurrent)
-	if err != nil {
-		return 0, err
-	}
-
-	// hash the body.  seek back to the first position after reading to reset
-	// the body for transmission.  copy errors may be assumed to be from the
-	// body.
-	n, err := io.Copy(dst, src)
-	if err != nil {
-		return n, err
-	}
-
-	_, err = src.Seek(curPos, sdkio.SeekStart)
-	if err != nil {
-		return n, err
-	}
-
-	return n, nil
-}
-
 // Adds the x-amz-te: append_md5 header to the request. This requests the service
 // responds with a trailing MD5 checksum.
 //

vendor/github.com/aws/aws-sdk-go/service/s3/customizations.go

@@ -3,8 +3,8 @@ package s3
 import (
 	"github.com/aws/aws-sdk-go/aws/client"
 	"github.com/aws/aws-sdk-go/aws/request"
-	"github.com/aws/aws-sdk-go/internal/s3err"
-	"github.com/aws/aws-sdk-go/service/s3/internal/arn"
+	"github.com/aws/aws-sdk-go/internal/s3shared/arn"
+	"github.com/aws/aws-sdk-go/internal/s3shared/s3err"
 )
 
 func init() {
@@ -33,12 +33,6 @@ func defaultInitRequestFn(r *request.Request) {
 	platformRequestHandlers(r)
 
 	switch r.Operation.Name {
-	case opPutBucketCors, opPutBucketLifecycle, opPutBucketPolicy,
-		opPutBucketTagging, opDeleteObjects, opPutBucketLifecycleConfiguration,
-		opPutObjectLegalHold, opPutObjectRetention, opPutObjectLockConfiguration,
-		opPutBucketReplication:
-		// These S3 operations require Content-MD5 to be set
-		r.Handlers.Build.PushBack(contentMD5)
 	case opGetBucketLocation:
 		// GetBucketLocation has custom parsing logic
 		r.Handlers.Unmarshal.PushFront(buildGetBucketLocation)
@@ -75,6 +69,8 @@ type copySourceSSECustomerKeyGetter interface {
 	getCopySourceSSECustomerKey() string
 }
 
+// endpointARNGetter is an accessor interface to grab the
+// the field corresponding to an endpoint ARN input.
 type endpointARNGetter interface {
 	getEndpointARN() (arn.Resource, error)
 	hasEndpointARN() bool

vendor/github.com/aws/aws-sdk-go/service/s3/doc_custom.go

@@ -104,19 +104,6 @@
 // content from S3. The Encryption and Decryption clients can be used concurrently
 // once the client is created.
 //
-//    sess := session.Must(session.NewSession())
-//
-//    // Create the decryption client.
-//    svc := s3crypto.NewDecryptionClient(sess)
-//
-//    // The object will be downloaded from S3 and decrypted locally. By metadata
-//    // about the object's encryption will instruct the decryption client how
-//    // decrypt the content of the object. By default KMS is used for keys.
-//    result, err := svc.GetObject(&s3.GetObjectInput {
-//        Bucket: aws.String(myBucket),
-//        Key: aws.String(myKey),
-//    })
-//
 // See the s3crypto package documentation for more information.
 // https://docs.aws.amazon.com/sdk-for-go/api/service/s3/s3crypto/
 //

vendor/github.com/aws/aws-sdk-go/service/s3/endpoint.go

@@ -6,11 +6,9 @@ import (
 
 	"github.com/aws/aws-sdk-go/aws"
 	awsarn "github.com/aws/aws-sdk-go/aws/arn"
-	"github.com/aws/aws-sdk-go/aws/awserr"
-	"github.com/aws/aws-sdk-go/aws/endpoints"
 	"github.com/aws/aws-sdk-go/aws/request"
-	"github.com/aws/aws-sdk-go/private/protocol"
-	"github.com/aws/aws-sdk-go/service/s3/internal/arn"
+	"github.com/aws/aws-sdk-go/internal/s3shared"
+	"github.com/aws/aws-sdk-go/internal/s3shared/arn"
 )
 
 // Used by shapes with members decorated as endpoint ARN.
@@ -22,12 +20,66 @@ func accessPointResourceParser(a awsarn.ARN) (arn.Resource, error) {
 	resParts := arn.SplitResource(a.Resource)
 	switch resParts[0] {
 	case "accesspoint":
+		if a.Service != "s3" {
+			return arn.AccessPointARN{}, arn.InvalidARNError{ARN: a, Reason: "service is not s3"}
+		}
 		return arn.ParseAccessPointResource(a, resParts[1:])
+	case "outpost":
+		if a.Service != "s3-outposts" {
+			return arn.OutpostAccessPointARN{}, arn.InvalidARNError{ARN: a, Reason: "service is not s3-outposts"}
+		}
+		return parseOutpostAccessPointResource(a, resParts[1:])
 	default:
 		return nil, arn.InvalidARNError{ARN: a, Reason: "unknown resource type"}
 	}
 }
 
+// parseOutpostAccessPointResource attempts to parse the ARNs resource as an
+// outpost access-point resource.
+//
+// Supported Outpost AccessPoint ARN format:
+//	- ARN format: arn:{partition}:s3-outposts:{region}:{accountId}:outpost/{outpostId}/accesspoint/{accesspointName}
+//	- example: arn:aws:s3-outposts:us-west-2:012345678901:outpost/op-1234567890123456/accesspoint/myaccesspoint
+//
+func parseOutpostAccessPointResource(a awsarn.ARN, resParts []string) (arn.OutpostAccessPointARN, error) {
+	// outpost accesspoint arn is only valid if service is s3-outposts
+	if a.Service != "s3-outposts" {
+		return arn.OutpostAccessPointARN{}, arn.InvalidARNError{ARN: a, Reason: "service is not s3-outposts"}
+	}
+
+	if len(resParts) == 0 {
+		return arn.OutpostAccessPointARN{}, arn.InvalidARNError{ARN: a, Reason: "outpost resource-id not set"}
+	}
+
+	if len(resParts) < 3 {
+		return arn.OutpostAccessPointARN{}, arn.InvalidARNError{
+			ARN: a, Reason: "access-point resource not set in Outpost ARN",
+		}
+	}
+
+	resID := strings.TrimSpace(resParts[0])
+	if len(resID) == 0 {
+		return arn.OutpostAccessPointARN{}, arn.InvalidARNError{ARN: a, Reason: "outpost resource-id not set"}
+	}
+
+	var outpostAccessPointARN = arn.OutpostAccessPointARN{}
+	switch resParts[1] {
+	case "accesspoint":
+		accessPointARN, err := arn.ParseAccessPointResource(a, resParts[2:])
+		if err != nil {
+			return arn.OutpostAccessPointARN{}, err
+		}
+		// set access-point arn
+		outpostAccessPointARN.AccessPointARN = accessPointARN
+	default:
+		return arn.OutpostAccessPointARN{}, arn.InvalidARNError{ARN: a, Reason: "access-point resource not set in Outpost ARN"}
+	}
+
+	// set outpost id
+	outpostAccessPointARN.OutpostID = resID
+	return outpostAccessPointARN, nil
+}
+
 func endpointHandler(req *request.Request) {
 	endpoint, ok := req.Params.(endpointARNGetter)
 	if !ok || !endpoint.hasEndpointARN() {
@@ -37,29 +89,29 @@ func endpointHandler(req *request.Request) {
 
 	resource, err := endpoint.getEndpointARN()
 	if err != nil {
-		req.Error = newInvalidARNError(nil, err)
+		req.Error = s3shared.NewInvalidARNError(nil, err)
 		return
 	}
 
-	resReq := resourceRequest{
+	resReq := s3shared.ResourceRequest{
 		Resource: resource,
 		Request:  req,
 	}
 
 	if resReq.IsCrossPartition() {
-		req.Error = newClientPartitionMismatchError(resource,
+		req.Error = s3shared.NewClientPartitionMismatchError(resource,
 			req.ClientInfo.PartitionID, aws.StringValue(req.Config.Region), nil)
 		return
 	}
 
 	if !resReq.AllowCrossRegion() && resReq.IsCrossRegion() {
-		req.Error = newClientRegionMismatchError(resource,
+		req.Error = s3shared.NewClientRegionMismatchError(resource,
 			req.ClientInfo.PartitionID, aws.StringValue(req.Config.Region), nil)
 		return
 	}
 
 	if resReq.HasCustomEndpoint() {
-		req.Error = newInvalidARNWithCustomEndpointError(resource, nil)
+		req.Error = s3shared.NewInvalidARNWithCustomEndpointError(resource, nil)
 		return
 	}
 
@@ -69,47 +121,22 @@ func endpointHandler(req *request.Request) {
 		if err != nil {
 			req.Error = err
 		}
+	case arn.OutpostAccessPointARN:
+		// outposts does not support FIPS regions
+		if resReq.ResourceConfiguredForFIPS() {
+			req.Error = s3shared.NewInvalidARNWithFIPSError(resource, nil)
+			return
+		}
+
+		err = updateRequestOutpostAccessPointEndpoint(req, tv)
+		if err != nil {
+			req.Error = err
+		}
 	default:
-		req.Error = newInvalidARNError(resource, nil)
+		req.Error = s3shared.NewInvalidARNError(resource, nil)
 	}
 }
 
-type resourceRequest struct {
-	Resource arn.Resource
-	Request  *request.Request
-}
-
-func (r resourceRequest) ARN() awsarn.ARN {
-	return r.Resource.GetARN()
-}
-
-func (r resourceRequest) AllowCrossRegion() bool {
-	return aws.BoolValue(r.Request.Config.S3UseARNRegion)
-}
-
-func (r resourceRequest) UseFIPS() bool {
-	return isFIPS(aws.StringValue(r.Request.Config.Region))
-}
-
-func (r resourceRequest) IsCrossPartition() bool {
-	return r.Request.ClientInfo.PartitionID != r.Resource.GetARN().Partition
-}
-
-func (r resourceRequest) IsCrossRegion() bool {
-	return isCrossRegion(r.Request, r.Resource.GetARN().Region)
-}
-
-func (r resourceRequest) HasCustomEndpoint() bool {
-	return len(aws.StringValue(r.Request.Config.Endpoint)) > 0
-}
-
-func isFIPS(clientRegion string) bool {
-	return strings.HasPrefix(clientRegion, "fips-") || strings.HasSuffix(clientRegion, "-fips")
-}
-func isCrossRegion(req *request.Request, otherRegion string) bool {
-	return req.ClientInfo.SigningRegion != otherRegion
-}
-
 func updateBucketEndpointFromParams(r *request.Request) {
 	bucket, ok := bucketNameFromReqParams(r.Params)
 	if !ok {
@@ -124,7 +151,7 @@ func updateBucketEndpointFromParams(r *request.Request) {
 func updateRequestAccessPointEndpoint(req *request.Request, accessPoint arn.AccessPointARN) error {
 	// Accelerate not supported
 	if aws.BoolValue(req.Config.S3UseAccelerate) {
-		return newClientConfiguredForAccelerateError(accessPoint,
+		return s3shared.NewClientConfiguredForAccelerateError(accessPoint,
 			req.ClientInfo.PartitionID, aws.StringValue(req.Config.Region), nil)
 	}
 
@@ -132,7 +159,7 @@ func updateRequestAccessPointEndpoint(req *request.Request, accessPoint arn.Acce
 	// are not supported.
 	req.Config.DisableEndpointHostPrefix = aws.Bool(false)
 
-	if err := accessPointEndpointBuilder(accessPoint).Build(req); err != nil {
+	if err := accessPointEndpointBuilder(accessPoint).build(req); err != nil {
 		return err
 	}
 
@@ -141,93 +168,34 @@ func updateRequestAccessPointEndpoint(req *request.Request, accessPoint arn.Acce
 	return nil
 }
 
+func updateRequestOutpostAccessPointEndpoint(req *request.Request, accessPoint arn.OutpostAccessPointARN) error {
+	// Accelerate not supported
+	if aws.BoolValue(req.Config.S3UseAccelerate) {
+		return s3shared.NewClientConfiguredForAccelerateError(accessPoint,
+			req.ClientInfo.PartitionID, aws.StringValue(req.Config.Region), nil)
+	}
+
+	// Dualstack not supported
+	if aws.BoolValue(req.Config.UseDualStack) {
+		return s3shared.NewClientConfiguredForDualStackError(accessPoint,
+			req.ClientInfo.PartitionID, aws.StringValue(req.Config.Region), nil)
+	}
+
+	// Ignore the disable host prefix for access points since custom endpoints
+	// are not supported.
+	req.Config.DisableEndpointHostPrefix = aws.Bool(false)
+
+	if err := outpostAccessPointEndpointBuilder(accessPoint).build(req); err != nil {
+		return err
+	}
+
+	removeBucketFromPath(req.HTTPRequest.URL)
+	return nil
+}
+
 func removeBucketFromPath(u *url.URL) {
 	u.Path = strings.Replace(u.Path, "/{Bucket}", "", -1)
 	if u.Path == "" {
 		u.Path = "/"
 	}
 }
-
-type accessPointEndpointBuilder arn.AccessPointARN
-
-const (
-	accessPointPrefixLabel   = "accesspoint"
-	accountIDPrefixLabel     = "accountID"
-	accesPointPrefixTemplate = "{" + accessPointPrefixLabel + "}-{" + accountIDPrefixLabel + "}."
-)
-
-func (a accessPointEndpointBuilder) Build(req *request.Request) error {
-	resolveRegion := arn.AccessPointARN(a).Region
-	cfgRegion := aws.StringValue(req.Config.Region)
-
-	if isFIPS(cfgRegion) {
-		if aws.BoolValue(req.Config.S3UseARNRegion) && isCrossRegion(req, resolveRegion) {
-			// FIPS with cross region is not supported, the SDK must fail
-			// because there is no well defined method for SDK to construct a
-			// correct FIPS endpoint.
-			return newClientConfiguredForCrossRegionFIPSError(arn.AccessPointARN(a),
-				req.ClientInfo.PartitionID, cfgRegion, nil)
-		}
-		resolveRegion = cfgRegion
-	}
-
-	endpoint, err := resolveRegionalEndpoint(req, resolveRegion)
-	if err != nil {
-		return newFailedToResolveEndpointError(arn.AccessPointARN(a),
-			req.ClientInfo.PartitionID, cfgRegion, err)
-	}
-
-	if err = updateRequestEndpoint(req, endpoint.URL); err != nil {
-		return err
-	}
-
-	const serviceEndpointLabel = "s3-accesspoint"
-
-	// dualstack provided by endpoint resolver
-	cfgHost := req.HTTPRequest.URL.Host
-	if strings.HasPrefix(cfgHost, "s3") {
-		req.HTTPRequest.URL.Host = serviceEndpointLabel + cfgHost[2:]
-	}
-
-	protocol.HostPrefixBuilder{
-		Prefix:   accesPointPrefixTemplate,
-		LabelsFn: a.hostPrefixLabelValues,
-	}.Build(req)
-
-	req.ClientInfo.SigningName = endpoint.SigningName
-	req.ClientInfo.SigningRegion = endpoint.SigningRegion
-
-	err = protocol.ValidateEndpointHost(req.Operation.Name, req.HTTPRequest.URL.Host)
-	if err != nil {
-		return newInvalidARNError(arn.AccessPointARN(a), err)
-	}
-
-	return nil
-}
-
-func (a accessPointEndpointBuilder) hostPrefixLabelValues() map[string]string {
-	return map[string]string{
-		accessPointPrefixLabel: arn.AccessPointARN(a).AccessPointName,
-		accountIDPrefixLabel:   arn.AccessPointARN(a).AccountID,
-	}
-}
-
-func resolveRegionalEndpoint(r *request.Request, region string) (endpoints.ResolvedEndpoint, error) {
-	return r.Config.EndpointResolver.EndpointFor(EndpointsID, region, func(opts *endpoints.Options) {
-		opts.DisableSSL = aws.BoolValue(r.Config.DisableSSL)
-		opts.UseDualStack = aws.BoolValue(r.Config.UseDualStack)
-		opts.S3UsEast1RegionalEndpoint = endpoints.RegionalS3UsEast1Endpoint
-	})
-}
-
-func updateRequestEndpoint(r *request.Request, endpoint string) (err error) {
-	endpoint = endpoints.AddScheme(endpoint, aws.BoolValue(r.Config.DisableSSL))
-
-	r.HTTPRequest.URL, err = url.Parse(endpoint + r.Operation.HTTPPath)
-	if err != nil {
-		return awserr.New(request.ErrCodeSerialization,
-			"failed to parse endpoint URL", err)
-	}
-
-	return nil
-}

vendor/github.com/aws/aws-sdk-go/service/s3/endpoint_builder.go

@@ -0,0 +1,177 @@
+package s3
+
+import (
+	"net/url"
+	"strings"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/aws/endpoints"
+	"github.com/aws/aws-sdk-go/aws/request"
+	"github.com/aws/aws-sdk-go/internal/s3shared"
+	"github.com/aws/aws-sdk-go/internal/s3shared/arn"
+	"github.com/aws/aws-sdk-go/private/protocol"
+)
+
+const (
+	accessPointPrefixLabel    = "accesspoint"
+	accountIDPrefixLabel      = "accountID"
+	accessPointPrefixTemplate = "{" + accessPointPrefixLabel + "}-{" + accountIDPrefixLabel + "}."
+
+	outpostPrefixLabel               = "outpost"
+	outpostAccessPointPrefixTemplate = accessPointPrefixTemplate + "{" + outpostPrefixLabel + "}."
+)
+
+// accessPointEndpointBuilder represents the endpoint builder for access point arn
+type accessPointEndpointBuilder arn.AccessPointARN
+
+// build builds the endpoint for corresponding access point arn
+//
+// For building an endpoint from access point arn, format used is:
+// - Access point endpoint format : {accesspointName}-{accountId}.s3-accesspoint.{region}.{dnsSuffix}
+// - example : myaccesspoint-012345678901.s3-accesspoint.us-west-2.amazonaws.com
+//
+// Access Point Endpoint requests are signed using "s3" as signing name.
+//
+func (a accessPointEndpointBuilder) build(req *request.Request) error {
+	resolveService := arn.AccessPointARN(a).Service
+	resolveRegion := arn.AccessPointARN(a).Region
+	cfgRegion := aws.StringValue(req.Config.Region)
+
+	if s3shared.IsFIPS(cfgRegion) {
+		if aws.BoolValue(req.Config.S3UseARNRegion) && s3shared.IsCrossRegion(req, resolveRegion) {
+			// FIPS with cross region is not supported, the SDK must fail
+			// because there is no well defined method for SDK to construct a
+			// correct FIPS endpoint.
+			return s3shared.NewClientConfiguredForCrossRegionFIPSError(arn.AccessPointARN(a),
+				req.ClientInfo.PartitionID, cfgRegion, nil)
+		}
+		resolveRegion = cfgRegion
+	}
+
+	endpoint, err := resolveRegionalEndpoint(req, resolveRegion, resolveService)
+	if err != nil {
+		return s3shared.NewFailedToResolveEndpointError(arn.AccessPointARN(a),
+			req.ClientInfo.PartitionID, cfgRegion, err)
+	}
+
+	if err = updateRequestEndpoint(req, endpoint.URL); err != nil {
+		return err
+	}
+
+	const serviceEndpointLabel = "s3-accesspoint"
+
+	// dual stack provided by endpoint resolver
+	cfgHost := req.HTTPRequest.URL.Host
+	if strings.HasPrefix(cfgHost, "s3") {
+		req.HTTPRequest.URL.Host = serviceEndpointLabel + cfgHost[2:]
+	}
+
+	protocol.HostPrefixBuilder{
+		Prefix:   accessPointPrefixTemplate,
+		LabelsFn: a.hostPrefixLabelValues,
+	}.Build(req)
+
+	// signer redirection
+	redirectSigner(req, endpoint.SigningName, endpoint.SigningRegion)
+
+	err = protocol.ValidateEndpointHost(req.Operation.Name, req.HTTPRequest.URL.Host)
+	if err != nil {
+		return s3shared.NewInvalidARNError(arn.AccessPointARN(a), err)
+	}
+
+	return nil
+}
+
+func (a accessPointEndpointBuilder) hostPrefixLabelValues() map[string]string {
+	return map[string]string{
+		accessPointPrefixLabel: arn.AccessPointARN(a).AccessPointName,
+		accountIDPrefixLabel:   arn.AccessPointARN(a).AccountID,
+	}
+}
+
+// outpostAccessPointEndpointBuilder represents the Endpoint builder for outpost access point arn.
+type outpostAccessPointEndpointBuilder arn.OutpostAccessPointARN
+
+// build builds an endpoint corresponding to the outpost access point arn.
+//
+// For building an endpoint from outpost access point arn, format used is:
+// - Outpost access point endpoint format : {accesspointName}-{accountId}.{outpostId}.s3-outposts.{region}.{dnsSuffix}
+// - example : myaccesspoint-012345678901.op-01234567890123456.s3-outposts.us-west-2.amazonaws.com
+//
+// Outpost AccessPoint Endpoint request are signed using "s3-outposts" as signing name.
+//
+func (o outpostAccessPointEndpointBuilder) build(req *request.Request) error {
+	resolveRegion := o.Region
+	resolveService := o.Service
+
+	endpointsID := resolveService
+	if resolveService == "s3-outposts" {
+		endpointsID = "s3"
+	}
+
+	endpoint, err := resolveRegionalEndpoint(req, resolveRegion, endpointsID)
+	if err != nil {
+		return s3shared.NewFailedToResolveEndpointError(o,
+			req.ClientInfo.PartitionID, resolveRegion, err)
+	}
+
+	if err = updateRequestEndpoint(req, endpoint.URL); err != nil {
+		return err
+	}
+
+	// add url host as s3-outposts
+	cfgHost := req.HTTPRequest.URL.Host
+	if strings.HasPrefix(cfgHost, endpointsID) {
+		req.HTTPRequest.URL.Host = resolveService + cfgHost[len(endpointsID):]
+	}
+
+	protocol.HostPrefixBuilder{
+		Prefix:   outpostAccessPointPrefixTemplate,
+		LabelsFn: o.hostPrefixLabelValues,
+	}.Build(req)
+
+	// set the signing region, name to resolved names from ARN
+	redirectSigner(req, resolveService, resolveRegion)
+
+	err = protocol.ValidateEndpointHost(req.Operation.Name, req.HTTPRequest.URL.Host)
+	if err != nil {
+		return s3shared.NewInvalidARNError(o, err)
+	}
+
+	return nil
+}
+
+func (o outpostAccessPointEndpointBuilder) hostPrefixLabelValues() map[string]string {
+	return map[string]string{
+		accessPointPrefixLabel: o.AccessPointName,
+		accountIDPrefixLabel:   o.AccountID,
+		outpostPrefixLabel:     o.OutpostID,
+	}
+}
+
+func resolveRegionalEndpoint(r *request.Request, region string, endpointsID string) (endpoints.ResolvedEndpoint, error) {
+	return r.Config.EndpointResolver.EndpointFor(endpointsID, region, func(opts *endpoints.Options) {
+		opts.DisableSSL = aws.BoolValue(r.Config.DisableSSL)
+		opts.UseDualStack = aws.BoolValue(r.Config.UseDualStack)
+		opts.S3UsEast1RegionalEndpoint = endpoints.RegionalS3UsEast1Endpoint
+	})
+}
+
+func updateRequestEndpoint(r *request.Request, endpoint string) (err error) {
+	endpoint = endpoints.AddScheme(endpoint, aws.BoolValue(r.Config.DisableSSL))
+
+	r.HTTPRequest.URL, err = url.Parse(endpoint + r.Operation.HTTPPath)
+	if err != nil {
+		return awserr.New(request.ErrCodeSerialization,
+			"failed to parse endpoint URL", err)
+	}
+
+	return nil
+}
+
+// redirectSigner sets signing name, signing region for a request
+func redirectSigner(req *request.Request, signingName string, signingRegion string) {
+	req.ClientInfo.SigningName = signingName
+	req.ClientInfo.SigningRegion = signingRegion
+}

vendor/github.com/aws/aws-sdk-go/service/s3/endpoint_errors.go

@@ -1,151 +0,0 @@
-package s3
-
-import (
-	"fmt"
-
-	"github.com/aws/aws-sdk-go/aws/awserr"
-	"github.com/aws/aws-sdk-go/service/s3/internal/arn"
-)
-
-const (
-	invalidARNErrorErrCode    = "InvalidARNError"
-	configurationErrorErrCode = "ConfigurationError"
-)
-
-type invalidARNError struct {
-	message  string
-	resource arn.Resource
-	origErr  error
-}
-
-func (e invalidARNError) Error() string {
-	var extra string
-	if e.resource != nil {
-		extra = "ARN: " + e.resource.String()
-	}
-	return awserr.SprintError(e.Code(), e.Message(), extra, e.origErr)
-}
-
-func (e invalidARNError) Code() string {
-	return invalidARNErrorErrCode
-}
-
-func (e invalidARNError) Message() string {
-	return e.message
-}
-
-func (e invalidARNError) OrigErr() error {
-	return e.origErr
-}
-
-func newInvalidARNError(resource arn.Resource, err error) invalidARNError {
-	return invalidARNError{
-		message:  "invalid ARN",
-		origErr:  err,
-		resource: resource,
-	}
-}
-
-func newInvalidARNWithCustomEndpointError(resource arn.Resource, err error) invalidARNError {
-	return invalidARNError{
-		message:  "resource ARN not supported with custom client endpoints",
-		origErr:  err,
-		resource: resource,
-	}
-}
-
-// ARN not supported for the target partition
-func newInvalidARNWithUnsupportedPartitionError(resource arn.Resource, err error) invalidARNError {
-	return invalidARNError{
-		message:  "resource ARN not supported for the target ARN partition",
-		origErr:  err,
-		resource: resource,
-	}
-}
-
-type configurationError struct {
-	message           string
-	resource          arn.Resource
-	clientPartitionID string
-	clientRegion      string
-	origErr           error
-}
-
-func (e configurationError) Error() string {
-	extra := fmt.Sprintf("ARN: %s, client partition: %s, client region: %s",
-		e.resource, e.clientPartitionID, e.clientRegion)
-
-	return awserr.SprintError(e.Code(), e.Message(), extra, e.origErr)
-}
-
-func (e configurationError) Code() string {
-	return configurationErrorErrCode
-}
-
-func (e configurationError) Message() string {
-	return e.message
-}
-
-func (e configurationError) OrigErr() error {
-	return e.origErr
-}
-
-func newClientPartitionMismatchError(resource arn.Resource, clientPartitionID, clientRegion string, err error) configurationError {
-	return configurationError{
-		message:           "client partition does not match provided ARN partition",
-		origErr:           err,
-		resource:          resource,
-		clientPartitionID: clientPartitionID,
-		clientRegion:      clientRegion,
-	}
-}
-
-func newClientRegionMismatchError(resource arn.Resource, clientPartitionID, clientRegion string, err error) configurationError {
-	return configurationError{
-		message:           "client region does not match provided ARN region",
-		origErr:           err,
-		resource:          resource,
-		clientPartitionID: clientPartitionID,
-		clientRegion:      clientRegion,
-	}
-}
-
-func newFailedToResolveEndpointError(resource arn.Resource, clientPartitionID, clientRegion string, err error) configurationError {
-	return configurationError{
-		message:           "endpoint resolver failed to find an endpoint for the provided ARN region",
-		origErr:           err,
-		resource:          resource,
-		clientPartitionID: clientPartitionID,
-		clientRegion:      clientRegion,
-	}
-}
-
-func newClientConfiguredForFIPSError(resource arn.Resource, clientPartitionID, clientRegion string, err error) configurationError {
-	return configurationError{
-		message:           "client configured for fips but cross-region resource ARN provided",
-		origErr:           err,
-		resource:          resource,
-		clientPartitionID: clientPartitionID,
-		clientRegion:      clientRegion,
-	}
-}
-
-func newClientConfiguredForAccelerateError(resource arn.Resource, clientPartitionID, clientRegion string, err error) configurationError {
-	return configurationError{
-		message:           "client configured for S3 Accelerate but is supported with resource ARN",
-		origErr:           err,
-		resource:          resource,
-		clientPartitionID: clientPartitionID,
-		clientRegion:      clientRegion,
-	}
-}
-
-func newClientConfiguredForCrossRegionFIPSError(resource arn.Resource, clientPartitionID, clientRegion string, err error) configurationError {
-	return configurationError{
-		message:           "client configured for FIPS with cross-region enabled but is supported with cross-region resource ARN",
-		origErr:           err,
-		resource:          resource,
-		clientPartitionID: clientPartitionID,
-		clientRegion:      clientRegion,
-	}
-}

vendor/github.com/aws/aws-sdk-go/service/s3/errors.go

@@ -8,7 +8,7 @@ const (
 	// "BucketAlreadyExists".
 	//
 	// The requested bucket name is not available. The bucket namespace is shared
-	// by all users of the system. Please select a different name and try again.
+	// by all users of the system. Select a different name and try again.
 	ErrCodeBucketAlreadyExists = "BucketAlreadyExists"
 
 	// ErrCodeBucketAlreadyOwnedByYou for service response error code
@@ -21,6 +21,12 @@ const (
 	// bucket access control lists (ACLs).
 	ErrCodeBucketAlreadyOwnedByYou = "BucketAlreadyOwnedByYou"
 
+	// ErrCodeInvalidObjectState for service response error code
+	// "InvalidObjectState".
+	//
+	// Object is archived and inaccessible until restored.
+	ErrCodeInvalidObjectState = "InvalidObjectState"
+
 	// ErrCodeNoSuchBucket for service response error code
 	// "NoSuchBucket".
 	//

vendor/github.com/aws/aws-sdk-go/service/s3/sse.go

@@ -69,7 +69,7 @@ func computeKeyMD5(keyHeader, keyMD5Header, key string, r *http.Request) {
 			return
 		}
 
-		// In backwards compatiable, the header's value is not base64 encoded,
+		// In backwards compatible, the header's value is not base64 encoded,
 		// and needs to be encoded and updated by the SDK's customizations.
 		b64Key := base64.StdEncoding.EncodeToString([]byte(key))
 		r.Header.Set(keyHeader, b64Key)

vendor/github.com/aws/aws-sdk-go/service/sts/api.go

@@ -207,6 +207,10 @@ func (c *STS) AssumeRoleRequest(input *AssumeRoleInput) (req *request.Request, o
 //   and Deactivating AWS STS in an AWS Region (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html)
 //   in the IAM User Guide.
 //
+//   * ErrCodeExpiredTokenException "ExpiredTokenException"
+//   The web identity token that was passed is expired or is not valid. Get a
+//   new identity token from the identity provider and then retry the request.
+//
 // See also, https://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/AssumeRole
 func (c *STS) AssumeRole(input *AssumeRoleInput) (*AssumeRoleOutput, error) {
 	req, out := c.AssumeRoleRequest(input)
@@ -626,7 +630,7 @@ func (c *STS) AssumeRoleWithWebIdentityRequest(input *AssumeRoleWithWebIdentityI
 //    * Using Web Identity Federation API Operations for Mobile Apps (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_oidc_manual.html)
 //    and Federation Through a Web-based Identity Provider (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_assumerolewithwebidentity).
 //
-//    * Web Identity Federation Playground (https://web-identity-federation-playground.s3.amazonaws.com/index.html).
+//    * Web Identity Federation Playground (https://aws.amazon.com/blogs/aws/the-aws-web-identity-federation-playground/).
 //    Walk through the process of authenticating through Login with Amazon,
 //    Facebook, or Google, getting temporary security credentials, and then
 //    using those credentials to make a request to AWS.
@@ -1788,7 +1792,7 @@ type AssumeRoleWithSAMLInput struct {
 	// in the IAM User Guide.
 	//
 	// SAMLAssertion is a required field
-	SAMLAssertion *string `min:"4" type:"string" required:"true" sensitive:"true"`
+	SAMLAssertion *string `min:"4" type:"string" required:"true"`
 }
 
 // String returns the string representation
@@ -2100,7 +2104,7 @@ type AssumeRoleWithWebIdentityInput struct {
 	// the application makes an AssumeRoleWithWebIdentity call.
 	//
 	// WebIdentityToken is a required field
-	WebIdentityToken *string `min:"4" type:"string" required:"true" sensitive:"true"`
+	WebIdentityToken *string `min:"4" type:"string" required:"true"`
 }
 
 // String returns the string representation

vendor/github.com/aws/aws-sdk-go/service/sts/doc.go

@@ -3,87 +3,11 @@
 // Package sts provides the client and types for making API
 // requests to AWS Security Token Service.
 //
-// The AWS Security Token Service (STS) is a web service that enables you to
-// request temporary, limited-privilege credentials for AWS Identity and Access
-// Management (IAM) users or for users that you authenticate (federated users).
-// This guide provides descriptions of the STS API. For more detailed information
-// about using this service, go to Temporary Security Credentials (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html).
-//
-// For information about setting up signatures and authorization through the
-// API, go to Signing AWS API Requests (https://docs.aws.amazon.com/general/latest/gr/signing_aws_api_requests.html)
-// in the AWS General Reference. For general information about the Query API,
-// go to Making Query Requests (https://docs.aws.amazon.com/IAM/latest/UserGuide/IAM_UsingQueryAPI.html)
-// in Using IAM. For information about using security tokens with other AWS
-// products, go to AWS Services That Work with IAM (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html)
-// in the IAM User Guide.
-//
-// If you're new to AWS and need additional technical information about a specific
-// AWS product, you can find the product's technical documentation at http://aws.amazon.com/documentation/
-// (http://aws.amazon.com/documentation/).
-//
-// Endpoints
-//
-// By default, AWS Security Token Service (STS) is available as a global service,
-// and all AWS STS requests go to a single endpoint at https://sts.amazonaws.com.
-// Global requests map to the US East (N. Virginia) region. AWS recommends using
-// Regional AWS STS endpoints instead of the global endpoint to reduce latency,
-// build in redundancy, and increase session token validity. For more information,
-// see Managing AWS STS in an AWS Region (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html)
-// in the IAM User Guide.
-//
-// Most AWS Regions are enabled for operations in all AWS services by default.
-// Those Regions are automatically activated for use with AWS STS. Some Regions,
-// such as Asia Pacific (Hong Kong), must be manually enabled. To learn more
-// about enabling and disabling AWS Regions, see Managing AWS Regions (https://docs.aws.amazon.com/general/latest/gr/rande-manage.html)
-// in the AWS General Reference. When you enable these AWS Regions, they are
-// automatically activated for use with AWS STS. You cannot activate the STS
-// endpoint for a Region that is disabled. Tokens that are valid in all AWS
-// Regions are longer than tokens that are valid in Regions that are enabled
-// by default. Changing this setting might affect existing systems where you
-// temporarily store tokens. For more information, see Managing Global Endpoint
-// Session Tokens (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html#sts-regions-manage-tokens)
-// in the IAM User Guide.
-//
-// After you activate a Region for use with AWS STS, you can direct AWS STS
-// API calls to that Region. AWS STS recommends that you provide both the Region
-// and endpoint when you make calls to a Regional endpoint. You can provide
-// the Region alone for manually enabled Regions, such as Asia Pacific (Hong
-// Kong). In this case, the calls are directed to the STS Regional endpoint.
-// However, if you provide the Region alone for Regions enabled by default,
-// the calls are directed to the global endpoint of https://sts.amazonaws.com.
-//
-// To view the list of AWS STS endpoints and whether they are active by default,
-// see Writing Code to Use AWS STS Regions (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html#id_credentials_temp_enable-regions_writing_code)
-// in the IAM User Guide.
-//
-// Recording API requests
-//
-// STS supports AWS CloudTrail, which is a service that records AWS calls for
-// your AWS account and delivers log files to an Amazon S3 bucket. By using
-// information collected by CloudTrail, you can determine what requests were
-// successfully made to STS, who made the request, when it was made, and so
-// on.
-//
-// If you activate AWS STS endpoints in Regions other than the default global
-// endpoint, then you must also turn on CloudTrail logging in those Regions.
-// This is necessary to record any AWS STS API calls that are made in those
-// Regions. For more information, see Turning On CloudTrail in Additional Regions
-// (https://docs.aws.amazon.com/awscloudtrail/latest/userguide/aggregating_logs_regions_turn_on_ct.html)
-// in the AWS CloudTrail User Guide.
-//
-// AWS Security Token Service (STS) is a global service with a single endpoint
-// at https://sts.amazonaws.com. Calls to this endpoint are logged as calls
-// to a global service. However, because this endpoint is physically located
-// in the US East (N. Virginia) Region, your logs list us-east-1 as the event
-// Region. CloudTrail does not write these logs to the US East (Ohio) Region
-// unless you choose to include global service logs in that Region. CloudTrail
-// writes calls to all Regional endpoints to their respective Regions. For example,
-// calls to sts.us-east-2.amazonaws.com are published to the US East (Ohio)
-// Region and calls to sts.eu-central-1.amazonaws.com are published to the EU
-// (Frankfurt) Region.
-//
-// To learn more about CloudTrail, including how to turn it on and find your
-// log files, see the AWS CloudTrail User Guide (https://docs.aws.amazon.com/awscloudtrail/latest/userguide/what_is_cloud_trail_top_level.html).
+// AWS Security Token Service (STS) enables you to request temporary, limited-privilege
+// credentials for AWS Identity and Access Management (IAM) users or for users
+// that you authenticate (federated users). This guide provides descriptions
+// of the STS API. For more information about using this service, see Temporary
+// Security Credentials (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html).
 //
 // See https://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15 for more information on this service.
 //

vendor/github.com/jmespath/go-jmespath/.travis.yml

@@ -12,6 +12,17 @@ go:
   - 1.11.x
   - 1.12.x
   - 1.13.x
+  - 1.14.x
+  - 1.15.x
+  - tip
 
-install: go get -v -t ./...
-script: make test
+allow_failures:
+  - go: tip
+
+script: make build
+
+matrix:
+  include:
+    - language: go
+      go: 1.15.x
+      script: make test

vendor/github.com/jmespath/go-jmespath/Makefile

@@ -1,6 +1,8 @@
 
 CMD = jpgo
 
+SRC_PKGS=./ ./cmd/... ./fuzz/...
+
 help:
 	@echo "Please use \`make <target>' where <target> is one of"
 	@echo "  test                    to run all the tests"
@@ -9,21 +11,22 @@ help:
 
 
 generate:
-	go generate ./...
+	go generate ${SRC_PKGS}
 
 build:
 	rm -f $(CMD)
-	go build ./...
+	go build ${SRC_PKGS}
 	rm -f cmd/$(CMD)/$(CMD) && cd cmd/$(CMD)/ && go build ./...
 	mv cmd/$(CMD)/$(CMD) .
 
-test:
-	go test -v ./...
+test: test-internal-testify
+	echo "making tests ${SRC_PKGS}"
+	go test -v ${SRC_PKGS}
 
 check:
-	go vet ./...
-	@echo "golint ./..."
-	@lint=`golint ./...`; \
+	go vet ${SRC_PKGS}
+	@echo "golint ${SRC_PKGS}"
+	@lint=`golint ${SRC_PKGS}`; \
 	lint=`echo "$$lint" | grep -v "astnodetype_string.go" | grep -v "toktype_string.go"`; \
 	echo "$$lint"; \
 	if [ "$$lint" != "" ]; then exit 1; fi
@@ -42,3 +45,7 @@ bench:
 
 pprof-cpu:
 	go tool pprof ./go-jmespath.test ./cpu.out
+
+test-internal-testify:
+	cd internal/testify && go test ./...
+

vendor/github.com/jmespath/go-jmespath/go.mod

@@ -2,4 +2,4 @@ module github.com/jmespath/go-jmespath
 
 go 1.14
 
-require github.com/stretchr/testify v1.5.1
+require github.com/jmespath/go-jmespath/internal/testify v1.5.1

vendor/github.com/jmespath/go-jmespath/go.sum

@@ -1,11 +1,11 @@
 github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
+github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/testify v1.5.1 h1:nOGnQDM7FYENwehXlg/kFVnos3rEvtKTjRvOWSzb6H4=
-github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v2 v2.2.2 h1:ZCJp+EgiOT7lHqUV2J862kp8Qj64Jo6az82+3Td9dZw=
-gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.8 h1:obN1ZagJSUGI0Ek/LBmuj4SNLPfIny3KsKFopxRdj10=
+gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=

vendor/golang.org/x/net/http/httpproxy/proxy.go

@@ -27,8 +27,7 @@ import (
 type Config struct {
 	// HTTPProxy represents the value of the HTTP_PROXY or
 	// http_proxy environment variable. It will be used as the proxy
-	// URL for HTTP requests and HTTPS requests unless overridden by
-	// HTTPSProxy or NoProxy.
+	// URL for HTTP requests unless overridden by NoProxy.
 	HTTPProxy string
 
 	// HTTPSProxy represents the HTTPS_PROXY or https_proxy
@@ -129,8 +128,7 @@ func (cfg *config) proxyForURL(reqURL *url.URL) (*url.URL, error) {
 	var proxy *url.URL
 	if reqURL.Scheme == "https" {
 		proxy = cfg.httpsProxy
-	}
-	if proxy == nil {
+	} else if reqURL.Scheme == "http" {
 		proxy = cfg.httpProxy
 		if proxy != nil && cfg.CGI {
 			return nil, errors.New("refusing to use HTTP_PROXY value in CGI environment; see golang.org/s/cgihttpproxy")

vendor/golang.org/x/net/http2/server.go

@@ -1694,6 +1694,7 @@ func (sc *serverConn) processData(f *DataFrame) error {
 		if len(data) > 0 {
 			wrote, err := st.body.Write(data)
 			if err != nil {
+				sc.sendWindowUpdate(nil, int(f.Length)-wrote)
 				return streamError(id, ErrCodeStreamClosed)
 			}
 			if wrote != len(data) {
@@ -2020,7 +2021,11 @@ func (sc *serverConn) newWriterAndRequest(st *stream, f *MetaHeadersFrame) (*res
 	}
 	if bodyOpen {
 		if vv, ok := rp.header["Content-Length"]; ok {
-			req.ContentLength, _ = strconv.ParseInt(vv[0], 10, 64)
+			if cl, err := strconv.ParseUint(vv[0], 10, 63); err == nil {
+				req.ContentLength = int64(cl)
+			} else {
+				req.ContentLength = 0
+			}
 		} else {
 			req.ContentLength = -1
 		}
@@ -2403,9 +2408,8 @@ func (rws *responseWriterState) writeChunk(p []byte) (n int, err error) {
 		var ctype, clen string
 		if clen = rws.snapHeader.Get("Content-Length"); clen != "" {
 			rws.snapHeader.Del("Content-Length")
-			clen64, err := strconv.ParseInt(clen, 10, 64)
-			if err == nil && clen64 >= 0 {
-				rws.sentContentLen = clen64
+			if cl, err := strconv.ParseUint(clen, 10, 63); err == nil {
+				rws.sentContentLen = int64(cl)
 			} else {
 				clen = ""
 			}

vendor/golang.org/x/net/http2/transport.go

@@ -154,12 +154,21 @@ func (t *Transport) pingTimeout() time.Duration {
 
 // ConfigureTransport configures a net/http HTTP/1 Transport to use HTTP/2.
 // It returns an error if t1 has already been HTTP/2-enabled.
+//
+// Use ConfigureTransports instead to configure the HTTP/2 Transport.
 func ConfigureTransport(t1 *http.Transport) error {
-	_, err := configureTransport(t1)
+	_, err := ConfigureTransports(t1)
 	return err
 }
 
-func configureTransport(t1 *http.Transport) (*Transport, error) {
+// ConfigureTransports configures a net/http HTTP/1 Transport to use HTTP/2.
+// It returns a new HTTP/2 Transport for further configuration.
+// It returns an error if t1 has already been HTTP/2-enabled.
+func ConfigureTransports(t1 *http.Transport) (*Transport, error) {
+	return configureTransports(t1)
+}
+
+func configureTransports(t1 *http.Transport) (*Transport, error) {
 	connPool := new(clientConnPool)
 	t2 := &Transport{
 		ConnPool: noDialClientConnPool{connPool},
@@ -689,6 +698,7 @@ func (t *Transport) newClientConn(c net.Conn, singleUse bool) (*ClientConn, erro
 	cc.inflow.add(transportDefaultConnFlow + initialWindowSize)
 	cc.bw.Flush()
 	if cc.werr != nil {
+		cc.Close()
 		return nil, cc.werr
 	}
 
@@ -1080,6 +1090,15 @@ func (cc *ClientConn) roundTrip(req *http.Request) (res *http.Response, gotErrAf
 	bodyWriter := cc.t.getBodyWriterState(cs, body)
 	cs.on100 = bodyWriter.on100
 
+	defer func() {
+		cc.wmu.Lock()
+		werr := cc.werr
+		cc.wmu.Unlock()
+		if werr != nil {
+			cc.Close()
+		}
+	}()
+
 	cc.wmu.Lock()
 	endStream := !hasBody && !hasTrailers
 	werr := cc.writeHeaders(cs.ID, endStream, int(cc.maxFrameSize), hdrs)
@@ -1129,6 +1148,9 @@ func (cc *ClientConn) roundTrip(req *http.Request) (res *http.Response, gotErrAf
 			// we can keep it.
 			bodyWriter.cancel()
 			cs.abortRequestBodyWrite(errStopReqBodyWrite)
+			if hasBody && !bodyWritten {
+				<-bodyWriter.resc
+			}
 		}
 		if re.err != nil {
 			cc.forgetStreamID(cs.ID)
@@ -1149,6 +1171,7 @@ func (cc *ClientConn) roundTrip(req *http.Request) (res *http.Response, gotErrAf
 			} else {
 				bodyWriter.cancel()
 				cs.abortRequestBodyWrite(errStopReqBodyWriteAndCancel)
+				<-bodyWriter.resc
 			}
 			cc.forgetStreamID(cs.ID)
 			return nil, cs.getStartedWrite(), errTimeout
@@ -1158,6 +1181,7 @@ func (cc *ClientConn) roundTrip(req *http.Request) (res *http.Response, gotErrAf
 			} else {
 				bodyWriter.cancel()
 				cs.abortRequestBodyWrite(errStopReqBodyWriteAndCancel)
+				<-bodyWriter.resc
 			}
 			cc.forgetStreamID(cs.ID)
 			return nil, cs.getStartedWrite(), ctx.Err()
@@ -1167,6 +1191,7 @@ func (cc *ClientConn) roundTrip(req *http.Request) (res *http.Response, gotErrAf
 			} else {
 				bodyWriter.cancel()
 				cs.abortRequestBodyWrite(errStopReqBodyWriteAndCancel)
+				<-bodyWriter.resc
 			}
 			cc.forgetStreamID(cs.ID)
 			return nil, cs.getStartedWrite(), errRequestCanceled
@@ -1176,6 +1201,7 @@ func (cc *ClientConn) roundTrip(req *http.Request) (res *http.Response, gotErrAf
 			// forgetStreamID.
 			return nil, cs.getStartedWrite(), cs.resetErr
 		case err := <-bodyWriter.resc:
+			bodyWritten = true
 			// Prefer the read loop's response, if available. Issue 16102.
 			select {
 			case re := <-readLoopResCh:
@@ -1186,7 +1212,6 @@ func (cc *ClientConn) roundTrip(req *http.Request) (res *http.Response, gotErrAf
 				cc.forgetStreamID(cs.ID)
 				return nil, cs.getStartedWrite(), err
 			}
-			bodyWritten = true
 			if d := cc.responseHeaderTimeout(); d != 0 {
 				timer := time.NewTimer(d)
 				defer timer.Stop()
@@ -2006,8 +2031,8 @@ func (rl *clientConnReadLoop) handleResponse(cs *clientStream, f *MetaHeadersFra
 	if !streamEnded || isHead {
 		res.ContentLength = -1
 		if clens := res.Header["Content-Length"]; len(clens) == 1 {
-			if clen64, err := strconv.ParseInt(clens[0], 10, 64); err == nil {
-				res.ContentLength = clen64
+			if cl, err := strconv.ParseUint(clens[0], 10, 63); err == nil {
+				res.ContentLength = int64(cl)
 			} else {
 				// TODO: care? unlike http/1, it won't mess up our framing, so it's
 				// more safe smuggling-wise to ignore.
@@ -2525,6 +2550,7 @@ func strSliceContains(ss []string, s string) bool {
 
 type erringRoundTripper struct{ err error }
 
+func (rt erringRoundTripper) RoundTripErr() error                             { return rt.err }
 func (rt erringRoundTripper) RoundTrip(*http.Request) (*http.Response, error) { return nil, rt.err }
 
 // gzipReader wraps a response body so it can lazily

vendor/golang.org/x/net/idna/tables12.0.0.go

@@ -1,6 +1,6 @@
 // Code generated by running "go generate" in golang.org/x/text. DO NOT EDIT.
 
-// +build go1.14
+// +build go1.14,!go1.16
 
 package idna
 

vendor/golang.org/x/net/internal/socket/cmsghdr.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build aix darwin dragonfly freebsd linux netbsd openbsd solaris
+// +build aix darwin dragonfly freebsd linux netbsd openbsd solaris zos
 
 package socket
 

vendor/golang.org/x/net/internal/socket/cmsghdr_stub.go

@@ -2,13 +2,23 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build !aix,!darwin,!dragonfly,!freebsd,!linux,!netbsd,!openbsd,!solaris
+// +build !aix,!darwin,!dragonfly,!freebsd,!linux,!netbsd,!openbsd,!solaris,!zos
 
 package socket
 
-type cmsghdr struct{}
+func controlHeaderLen() int {
+	return 0
+}
 
-const sizeofCmsghdr = 0
+func controlMessageLen(dataLen int) int {
+	return 0
+}
+
+func controlMessageSpace(dataLen int) int {
+	return 0
+}
+
+type cmsghdr struct{}
 
 func (h *cmsghdr) len() int { return 0 }
 func (h *cmsghdr) lvl() int { return 0 }

vendor/golang.org/x/net/internal/socket/cmsghdr_unix.go

@@ -0,0 +1,21 @@
+// Copyright 2020 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build aix darwin dragonfly freebsd linux netbsd openbsd solaris
+
+package socket
+
+import "golang.org/x/sys/unix"
+
+func controlHeaderLen() int {
+	return unix.CmsgLen(0)
+}
+
+func controlMessageLen(dataLen int) int {
+	return unix.CmsgLen(dataLen)
+}
+
+func controlMessageSpace(dataLen int) int {
+	return unix.CmsgSpace(dataLen)
+}

vendor/golang.org/x/net/internal/socket/cmsghdr_zos_s390x.go

@@ -0,0 +1,25 @@
+// Copyright 2020 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package socket
+
+import "syscall"
+
+func (h *cmsghdr) set(l, lvl, typ int) {
+	h.Len = int32(l)
+	h.Level = int32(lvl)
+	h.Type = int32(typ)
+}
+
+func controlHeaderLen() int {
+	return syscall.CmsgLen(0)
+}
+
+func controlMessageLen(dataLen int) int {
+	return syscall.CmsgLen(dataLen)
+}
+
+func controlMessageSpace(dataLen int) int {
+	return syscall.CmsgSpace(dataLen)
+}

vendor/golang.org/x/net/internal/socket/error_unix.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build aix darwin dragonfly freebsd linux netbsd openbsd solaris
+// +build aix darwin dragonfly freebsd linux netbsd openbsd solaris zos
 
 package socket
 

vendor/golang.org/x/net/internal/socket/iovec_64bit.go

@@ -3,7 +3,7 @@
 // license that can be found in the LICENSE file.
 
 // +build arm64 amd64 ppc64 ppc64le mips64 mips64le riscv64 s390x
-// +build aix darwin dragonfly freebsd linux netbsd openbsd
+// +build aix darwin dragonfly freebsd linux netbsd openbsd zos
 
 package socket
 

vendor/golang.org/x/net/internal/socket/iovec_stub.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build !aix,!darwin,!dragonfly,!freebsd,!linux,!netbsd,!openbsd,!solaris
+// +build !aix,!darwin,!dragonfly,!freebsd,!linux,!netbsd,!openbsd,!solaris,!zos
 
 package socket
 

vendor/golang.org/x/net/internal/socket/msghdr_stub.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build !aix,!darwin,!dragonfly,!freebsd,!linux,!netbsd,!openbsd,!solaris
+// +build !aix,!darwin,!dragonfly,!freebsd,!linux,!netbsd,!openbsd,!solaris,!zos
 
 package socket
 

vendor/golang.org/x/net/internal/socket/msghdr_zos_s390x.go

@@ -0,0 +1,36 @@
+// Copyright 2020 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// +build s390x
+// +build zos
+
+package socket
+
+import "unsafe"
+
+func (h *msghdr) pack(vs []iovec, bs [][]byte, oob []byte, sa []byte) {
+	for i := range vs {
+		vs[i].set(bs[i])
+	}
+	if len(vs) > 0 {
+		h.Iov = &vs[0]
+		h.Iovlen = int32(len(vs))
+	}
+	if len(oob) > 0 {
+		h.Control = (*byte)(unsafe.Pointer(&oob[0]))
+		h.Controllen = uint32(len(oob))
+	}
+	if sa != nil {
+		h.Name = (*byte)(unsafe.Pointer(&sa[0]))
+		h.Namelen = uint32(len(sa))
+	}
+}
+
+func (h *msghdr) controllen() int {
+	return int(h.Controllen)
+}
+
+func (h *msghdr) flags() int {
+	return int(h.Flags)
+}

vendor/golang.org/x/net/internal/socket/rawconn_msg.go

@@ -2,12 +2,13 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build aix darwin dragonfly freebsd linux netbsd openbsd solaris windows
+// +build aix darwin dragonfly freebsd linux netbsd openbsd solaris windows zos
 
 package socket
 
 import (
 	"os"
+	"runtime"
 	"syscall"
 )
 
@@ -24,7 +25,7 @@ func (c *Conn) recvMsg(m *Message, flags int) error {
 	var n int
 	fn := func(s uintptr) bool {
 		n, operr = recvmsg(s, &h, flags)
-		if operr == syscall.EAGAIN {
+		if operr == syscall.EAGAIN || (runtime.GOOS == "zos" && operr == syscall.EWOULDBLOCK) {
 			return false
 		}
 		return true
@@ -61,7 +62,7 @@ func (c *Conn) sendMsg(m *Message, flags int) error {
 	var n int
 	fn := func(s uintptr) bool {
 		n, operr = sendmsg(s, &h, flags)
-		if operr == syscall.EAGAIN {
+		if operr == syscall.EAGAIN || (runtime.GOOS == "zos" && operr == syscall.EWOULDBLOCK) {
 			return false
 		}
 		return true

vendor/golang.org/x/net/internal/socket/rawconn_nomsg.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-// +build !aix,!darwin,!dragonfly,!freebsd,!linux,!netbsd,!openbsd,!solaris,!windows
+// +build !aix,!darwin,!dragonfly,!freebsd,!linux,!netbsd,!openbsd,!solaris,!windows,!zos
 
 package socket
 

vendor/golang.org/x/net/internal/socket/socket.go

@@ -90,17 +90,9 @@ func (o *Option) SetInt(c *Conn, v int) error {
 	return o.set(c, b)
 }
 
-func controlHeaderLen() int {
-	return roundup(sizeofCmsghdr)
-}
-
-func controlMessageLen(dataLen int) int {
-	return roundup(sizeofCmsghdr) + dataLen
-}
-
 // ControlMessageSpace returns the whole length of control message.
 func ControlMessageSpace(dataLen int) int {
-	return roundup(sizeofCmsghdr) + roundup(dataLen)
+	return controlMessageSpace(dataLen)
 }
 
 // A ControlMessage represents the head message in a stream of control