Merge pull request #11657 from ioito/hotfix/qx-aws-waf-label

fix(region): support aws waf label

go.mod

@@ -29,7 +29,7 @@ require (
 	github.com/anacrolix/torrent v0.0.0-20181129073333-cc531b8c4a80
 	github.com/aokoli/goutils v1.0.1
 	github.com/apache/thrift v0.12.0 // indirect
-	github.com/aws/aws-sdk-go v1.36.31
+	github.com/aws/aws-sdk-go v1.39.0
 	github.com/baiyubin/aliyun-sts-go-sdk v0.0.0-20180326062324-cfa1a18b161f // indirect
 	github.com/beevik/etree v1.1.0 // indirect
 	github.com/benbjohnson/clock v1.0.0

go.sum

@@ -129,8 +129,8 @@ github.com/aokoli/goutils v1.0.1 h1:7fpzNGoJ3VA8qcrm++XEE1QUe0mIwNeLa02Nwq7RDkg=
 github.com/aokoli/goutils v1.0.1/go.mod h1:SijmP0QR8LtwsmDs8Yii5Z/S4trXFGFC2oO5g9DP+DQ=
 github.com/apache/thrift v0.12.0 h1:pODnxUFNcjP9UTLZGTdeh+j16A8lJbRvD3rOtrk/7bs=
 github.com/apache/thrift v0.12.0/go.mod h1:cp2SuWMxlEZw2r+iP2GNCdIi4C1qmUzdZFSVb+bacwQ=
-github.com/aws/aws-sdk-go v1.36.31 h1:BMVngapDGAfLBVEVzaSIw3fmJdWx7jOvhLCXgRXbXQI=
-github.com/aws/aws-sdk-go v1.36.31/go.mod h1:hcU610XS61/+aQV88ixoOzUoG7v3b31pl2zKMmprdro=
+github.com/aws/aws-sdk-go v1.39.0 h1:74BBwkEmiqBbi2CGflEh34l0YNtIibTjZsibGarkNjo=
+github.com/aws/aws-sdk-go v1.39.0/go.mod h1:hcU610XS61/+aQV88ixoOzUoG7v3b31pl2zKMmprdro=
 github.com/baiyubin/aliyun-sts-go-sdk v0.0.0-20180326062324-cfa1a18b161f h1:ZNv7On9kyUzm7fvRZumSyy/IUiSC7AzL0I1jKKtwooA=
 github.com/baiyubin/aliyun-sts-go-sdk v0.0.0-20180326062324-cfa1a18b161f/go.mod h1:AuiFmCCPBSrqvVMvuqFuk0qogytodnVFVSN5CeJB8Gc=
 github.com/beevik/etree v1.1.0 h1:T0xke/WvNtMoCqgzPhkX2r4rjY3GDZFi+FjpRZY2Jbs=

pkg/cloudprovider/waf.go

@@ -185,7 +185,7 @@ func (self SWafStatement) GetGlobalId() string {
 		self.ManagedRuleGroupName,
 		self.SearchString,
 	)
-	if self.Type == WafStatementTypeGeoMatch || self.Type == WafStatementTypeRate {
+	if self.Type == WafStatementTypeGeoMatch || self.Type == WafStatementTypeRate || self.Type == WafStatementTypeLabelMatch {
 		id = fmt.Sprintf("%s-%s", id, self.MatchFieldValues)
 	}
 	return id

pkg/multicloud/aws/waf_rules.go

@@ -173,6 +173,14 @@ func (self *sWafStatement) convert() cloudprovider.SWafStatement {
 		statement.Type = cloudprovider.WafStatementTypeXssMatch
 		fillStatement(&statement, self.XssMatchStatement.FieldToMatch)
 		fillTransformations(&statement, self.XssMatchStatement.TextTransformations)
+	} else if self.LabelMatchStatement != nil {
+		statement.Type = cloudprovider.WafStatementTypeLabelMatch
+		if self.LabelMatchStatement.Scope != nil {
+			statement.MatchFieldKey = *self.LabelMatchStatement.Scope
+		}
+		if self.LabelMatchStatement.Key != nil {
+			statement.MatchFieldValues = &cloudprovider.TWafMatchFieldValues{*self.LabelMatchStatement.Key}
+		}
 	}
 	return statement
 }

vendor/github.com/aws/aws-sdk-go/aws/client/client.go

@@ -88,10 +88,6 @@ func (c *Client) NewRequest(operation *request.Operation, params interface{}, da
 // AddDebugHandlers injects debug logging handlers into the service to log request
 // debug information.
 func (c *Client) AddDebugHandlers() {
-	if !c.Config.LogLevel.AtLeast(aws.LogDebug) {
-		return
-	}
-
 	c.Handlers.Send.PushFrontNamed(LogHTTPRequestHandler)
 	c.Handlers.Send.PushBackNamed(LogHTTPResponseHandler)
 }

vendor/github.com/aws/aws-sdk-go/aws/client/logger.go

@@ -53,6 +53,10 @@ var LogHTTPRequestHandler = request.NamedHandler{
 }
 
 func logRequest(r *request.Request) {
+	if !r.Config.LogLevel.AtLeast(aws.LogDebug) {
+		return
+	}
+
 	logBody := r.Config.LogLevel.Matches(aws.LogDebugWithHTTPBody)
 	bodySeekable := aws.IsReaderSeekable(r.Body)
 
@@ -120,6 +124,10 @@ var LogHTTPResponseHandler = request.NamedHandler{
 }
 
 func logResponse(r *request.Request) {
+	if !r.Config.LogLevel.AtLeast(aws.LogDebug) {
+		return
+	}
+
 	lw := &logWriter{r.Config.Logger, bytes.NewBuffer(nil)}
 
 	if r.HTTPResponse == nil {

vendor/github.com/aws/aws-sdk-go/aws/corehandlers/handlers.go

@@ -178,7 +178,7 @@ func handleSendError(r *request.Request, err error) {
 var ValidateResponseHandler = request.NamedHandler{Name: "core.ValidateResponseHandler", Fn: func(r *request.Request) {
 	if r.HTTPResponse.StatusCode == 0 || r.HTTPResponse.StatusCode >= 300 {
 		// this may be replaced by an UnmarshalError handler
-		r.Error = awserr.New("UnknownError", "unknown error", nil)
+		r.Error = awserr.New("UnknownError", "unknown error", r.Error)
 	}
 }}
 

vendor/github.com/aws/aws-sdk-go/aws/credentials/ssocreds/doc.go

@@ -0,0 +1,60 @@
+// Package ssocreds provides a credential provider for retrieving temporary AWS credentials using an SSO access token.
+//
+// IMPORTANT: The provider in this package does not initiate or perform the AWS SSO login flow. The SDK provider
+// expects that you have already performed the SSO login flow using AWS CLI using the "aws sso login" command, or by
+// some other mechanism. The provider must find a valid non-expired access token for the AWS SSO user portal URL in
+// ~/.aws/sso/cache. If a cached token is not found, it is expired, or the file is malformed an error will be returned.
+//
+// Loading AWS SSO credentials with the AWS shared configuration file
+//
+// You can use configure AWS SSO credentials from the AWS shared configuration file by
+// providing the specifying the required keys in the profile:
+//
+//  sso_account_id
+//  sso_region
+//  sso_role_name
+//  sso_start_url
+//
+// For example, the following defines a profile "devsso" and specifies the AWS SSO parameters that defines the target
+// account, role, sign-on portal, and the region where the user portal is located. Note: all SSO arguments must be
+// provided, or an error will be returned.
+//
+//  [profile devsso]
+//  sso_start_url = https://my-sso-portal.awsapps.com/start
+//  sso_role_name = SSOReadOnlyRole
+//  sso_region = us-east-1
+//  sso_account_id = 123456789012
+//
+// Using the config module, you can load the AWS SDK shared configuration, and specify that this profile be used to
+// retrieve credentials. For example:
+//
+//  sess, err := session.NewSessionWithOptions(session.Options{
+//      SharedConfigState: session.SharedConfigEnable,
+//      Profile:           "devsso",
+//  })
+//  if err != nil {
+//      return err
+//  }
+//
+// Programmatically loading AWS SSO credentials directly
+//
+// You can programmatically construct the AWS SSO Provider in your application, and provide the necessary information
+// to load and retrieve temporary credentials using an access token from ~/.aws/sso/cache.
+//
+//  svc := sso.New(sess, &aws.Config{
+//      Region: aws.String("us-west-2"), // Client Region must correspond to the AWS SSO user portal region
+//  })
+//
+//  provider := ssocreds.NewCredentialsWithClient(svc, "123456789012", "SSOReadOnlyRole", "https://my-sso-portal.awsapps.com/start")
+//
+//  credentials, err := provider.Get()
+//  if err != nil {
+//      return err
+//  }
+//
+// Additional Resources
+//
+// Configuring the AWS CLI to use AWS Single Sign-On: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html
+//
+// AWS Single Sign-On User Guide: https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html
+package ssocreds

vendor/github.com/aws/aws-sdk-go/aws/credentials/ssocreds/os.go

@@ -0,0 +1,9 @@
+// +build !windows
+
+package ssocreds
+
+import "os"
+
+func getHomeDirectory() string {
+	return os.Getenv("HOME")
+}

vendor/github.com/aws/aws-sdk-go/aws/credentials/ssocreds/os_windows.go

@@ -0,0 +1,7 @@
+package ssocreds
+
+import "os"
+
+func getHomeDirectory() string {
+	return os.Getenv("USERPROFILE")
+}

vendor/github.com/aws/aws-sdk-go/aws/credentials/ssocreds/provider.go

@@ -0,0 +1,180 @@
+package ssocreds
+
+import (
+	"crypto/sha1"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"io/ioutil"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/aws/client"
+	"github.com/aws/aws-sdk-go/aws/credentials"
+	"github.com/aws/aws-sdk-go/service/sso"
+	"github.com/aws/aws-sdk-go/service/sso/ssoiface"
+)
+
+// ErrCodeSSOProviderInvalidToken is the code type that is returned if loaded token has expired or is otherwise invalid.
+// To refresh the SSO session run aws sso login with the corresponding profile.
+const ErrCodeSSOProviderInvalidToken = "SSOProviderInvalidToken"
+
+const invalidTokenMessage = "the SSO session has expired or is invalid"
+
+func init() {
+	nowTime = time.Now
+	defaultCacheLocation = defaultCacheLocationImpl
+}
+
+var nowTime func() time.Time
+
+// ProviderName is the name of the provider used to specify the source of credentials.
+const ProviderName = "SSOProvider"
+
+var defaultCacheLocation func() string
+
+func defaultCacheLocationImpl() string {
+	return filepath.Join(getHomeDirectory(), ".aws", "sso", "cache")
+}
+
+// Provider is an AWS credential provider that retrieves temporary AWS credentials by exchanging an SSO login token.
+type Provider struct {
+	credentials.Expiry
+
+	// The Client which is configured for the AWS Region where the AWS SSO user portal is located.
+	Client ssoiface.SSOAPI
+
+	// The AWS account that is assigned to the user.
+	AccountID string
+
+	// The role name that is assigned to the user.
+	RoleName string
+
+	// The URL that points to the organization's AWS Single Sign-On (AWS SSO) user portal.
+	StartURL string
+}
+
+// NewCredentials returns a new AWS Single Sign-On (AWS SSO) credential provider. The ConfigProvider is expected to be configured
+// for the AWS Region where the AWS SSO user portal is located.
+func NewCredentials(configProvider client.ConfigProvider, accountID, roleName, startURL string, optFns ...func(provider *Provider)) *credentials.Credentials {
+	return NewCredentialsWithClient(sso.New(configProvider), accountID, roleName, startURL, optFns...)
+}
+
+// NewCredentialsWithClient returns a new AWS Single Sign-On (AWS SSO) credential provider. The provided client is expected to be configured
+// for the AWS Region where the AWS SSO user portal is located.
+func NewCredentialsWithClient(client ssoiface.SSOAPI, accountID, roleName, startURL string, optFns ...func(provider *Provider)) *credentials.Credentials {
+	p := &Provider{
+		Client:    client,
+		AccountID: accountID,
+		RoleName:  roleName,
+		StartURL:  startURL,
+	}
+
+	for _, fn := range optFns {
+		fn(p)
+	}
+
+	return credentials.NewCredentials(p)
+}
+
+// Retrieve retrieves temporary AWS credentials from the configured Amazon Single Sign-On (AWS SSO) user portal
+// by exchanging the accessToken present in ~/.aws/sso/cache.
+func (p *Provider) Retrieve() (credentials.Value, error) {
+	return p.RetrieveWithContext(aws.BackgroundContext())
+}
+
+// RetrieveWithContext retrieves temporary AWS credentials from the configured Amazon Single Sign-On (AWS SSO) user portal
+// by exchanging the accessToken present in ~/.aws/sso/cache.
+func (p *Provider) RetrieveWithContext(ctx credentials.Context) (credentials.Value, error) {
+	tokenFile, err := loadTokenFile(p.StartURL)
+	if err != nil {
+		return credentials.Value{}, err
+	}
+
+	output, err := p.Client.GetRoleCredentialsWithContext(ctx, &sso.GetRoleCredentialsInput{
+		AccessToken: &tokenFile.AccessToken,
+		AccountId:   &p.AccountID,
+		RoleName:    &p.RoleName,
+	})
+	if err != nil {
+		return credentials.Value{}, err
+	}
+
+	expireTime := time.Unix(0, aws.Int64Value(output.RoleCredentials.Expiration)*int64(time.Millisecond)).UTC()
+	p.SetExpiration(expireTime, 0)
+
+	return credentials.Value{
+		AccessKeyID:     aws.StringValue(output.RoleCredentials.AccessKeyId),
+		SecretAccessKey: aws.StringValue(output.RoleCredentials.SecretAccessKey),
+		SessionToken:    aws.StringValue(output.RoleCredentials.SessionToken),
+		ProviderName:    ProviderName,
+	}, nil
+}
+
+func getCacheFileName(url string) (string, error) {
+	hash := sha1.New()
+	_, err := hash.Write([]byte(url))
+	if err != nil {
+		return "", err
+	}
+	return strings.ToLower(hex.EncodeToString(hash.Sum(nil))) + ".json", nil
+}
+
+type rfc3339 time.Time
+
+func (r *rfc3339) UnmarshalJSON(bytes []byte) error {
+	var value string
+
+	if err := json.Unmarshal(bytes, &value); err != nil {
+		return err
+	}
+
+	parse, err := time.Parse(time.RFC3339, value)
+	if err != nil {
+		return fmt.Errorf("expected RFC3339 timestamp: %v", err)
+	}
+
+	*r = rfc3339(parse)
+
+	return nil
+}
+
+type token struct {
+	AccessToken string  `json:"accessToken"`
+	ExpiresAt   rfc3339 `json:"expiresAt"`
+	Region      string  `json:"region,omitempty"`
+	StartURL    string  `json:"startUrl,omitempty"`
+}
+
+func (t token) Expired() bool {
+	return nowTime().Round(0).After(time.Time(t.ExpiresAt))
+}
+
+func loadTokenFile(startURL string) (t token, err error) {
+	key, err := getCacheFileName(startURL)
+	if err != nil {
+		return token{}, awserr.New(ErrCodeSSOProviderInvalidToken, invalidTokenMessage, err)
+	}
+
+	fileBytes, err := ioutil.ReadFile(filepath.Join(defaultCacheLocation(), key))
+	if err != nil {
+		return token{}, awserr.New(ErrCodeSSOProviderInvalidToken, invalidTokenMessage, err)
+	}
+
+	if err := json.Unmarshal(fileBytes, &t); err != nil {
+		return token{}, awserr.New(ErrCodeSSOProviderInvalidToken, invalidTokenMessage, err)
+	}
+
+	if len(t.AccessToken) == 0 {
+		return token{}, awserr.New(ErrCodeSSOProviderInvalidToken, invalidTokenMessage, nil)
+	}
+
+	if t.Expired() {
+		return token{}, awserr.New(ErrCodeSSOProviderInvalidToken, invalidTokenMessage, nil)
+	}
+
+	return t, nil
+}

vendor/github.com/aws/aws-sdk-go/aws/credentials/stscreds/assume_role_provider.go

@@ -95,7 +95,7 @@ import (
 // StdinTokenProvider will prompt on stderr and read from stdin for a string value.
 // An error is returned if reading from stdin fails.
 //
-// Use this function go read MFA tokens from stdin. The function makes no attempt
+// Use this function to read MFA tokens from stdin. The function makes no attempt
 // to make atomic prompts from stdin across multiple gorouties.
 //
 // Using StdinTokenProvider with multiple AssumeRoleProviders, or Credentials will

vendor/github.com/aws/aws-sdk-go/aws/ec2metadata/service.go

@@ -13,7 +13,6 @@ package ec2metadata
 
 import (
 	"bytes"
-	"errors"
 	"io"
 	"net/http"
 	"net/url"
@@ -234,7 +233,8 @@ func unmarshalError(r *request.Request) {
 
 	// Response body format is not consistent between metadata endpoints.
 	// Grab the error message as a string and include that as the source error
-	r.Error = awserr.NewRequestFailure(awserr.New("EC2MetadataError", "failed to make EC2Metadata request", errors.New(b.String())),
+	r.Error = awserr.NewRequestFailure(
+		awserr.New("EC2MetadataError", "failed to make EC2Metadata request\n"+b.String(), nil),
 		r.HTTPResponse.StatusCode, r.RequestID)
 }
 

vendor/github.com/aws/aws-sdk-go/aws/endpoints/v3model.go

@@ -178,14 +178,14 @@ type service struct {
 }
 
 func (s *service) endpointForRegion(region string) (endpoint, bool) {
-	if s.IsRegionalized == boxedFalse {
-		return s.Endpoints[s.PartitionEndpoint], region == s.PartitionEndpoint
-	}
-
 	if e, ok := s.Endpoints[region]; ok {
 		return e, true
 	}
 
+	if s.IsRegionalized == boxedFalse {
+		return s.Endpoints[s.PartitionEndpoint], region == s.PartitionEndpoint
+	}
+
 	// Unable to find any matching endpoint, return
 	// blank that will be used for generic endpoint creation.
 	return endpoint{}, false

vendor/github.com/aws/aws-sdk-go/aws/request/request.go

@@ -129,12 +129,27 @@ func New(cfg aws.Config, clientInfo metadata.ClientInfo, handlers Handlers,
 	httpReq, _ := http.NewRequest(method, "", nil)
 
 	var err error
-	httpReq.URL, err = url.Parse(clientInfo.Endpoint + operation.HTTPPath)
+	httpReq.URL, err = url.Parse(clientInfo.Endpoint)
 	if err != nil {
 		httpReq.URL = &url.URL{}
 		err = awserr.New("InvalidEndpointURL", "invalid endpoint uri", err)
 	}
 
+	if len(operation.HTTPPath) != 0 {
+		opHTTPPath := operation.HTTPPath
+		var opQueryString string
+		if idx := strings.Index(opHTTPPath, "?"); idx >= 0 {
+			opQueryString = opHTTPPath[idx+1:]
+			opHTTPPath = opHTTPPath[:idx]
+		}
+
+		if strings.HasSuffix(httpReq.URL.Path, "/") && strings.HasPrefix(opHTTPPath, "/") {
+			opHTTPPath = opHTTPPath[1:]
+		}
+		httpReq.URL.Path += opHTTPPath
+		httpReq.URL.RawQuery = opQueryString
+	}
+
 	r := &Request{
 		Config:     cfg,
 		ClientInfo: clientInfo,

vendor/github.com/aws/aws-sdk-go/aws/session/credentials.go

@@ -9,6 +9,7 @@ import (
 	"github.com/aws/aws-sdk-go/aws/awserr"
 	"github.com/aws/aws-sdk-go/aws/credentials"
 	"github.com/aws/aws-sdk-go/aws/credentials/processcreds"
+	"github.com/aws/aws-sdk-go/aws/credentials/ssocreds"
 	"github.com/aws/aws-sdk-go/aws/credentials/stscreds"
 	"github.com/aws/aws-sdk-go/aws/defaults"
 	"github.com/aws/aws-sdk-go/aws/request"
@@ -100,10 +101,6 @@ func resolveCredsFromProfile(cfg *aws.Config,
 			sharedCfg.Creds,
 		)
 
-	case len(sharedCfg.CredentialProcess) != 0:
-		// Get credentials from CredentialProcess
-		creds = processcreds.NewCredentials(sharedCfg.CredentialProcess)
-
 	case len(sharedCfg.CredentialSource) != 0:
 		creds, err = resolveCredsFromSource(cfg, envCfg,
 			sharedCfg, handlers, sessOpts,
@@ -119,6 +116,13 @@ func resolveCredsFromProfile(cfg *aws.Config,
 			sharedCfg.RoleSessionName,
 		)
 
+	case sharedCfg.hasSSOConfiguration():
+		creds, err = resolveSSOCredentials(cfg, sharedCfg, handlers)
+
+	case len(sharedCfg.CredentialProcess) != 0:
+		// Get credentials from CredentialProcess
+		creds = processcreds.NewCredentials(sharedCfg.CredentialProcess)
+
 	default:
 		// Fallback to default credentials provider, include mock errors for
 		// the credential chain so user can identify why credentials failed to
@@ -151,6 +155,25 @@ func resolveCredsFromProfile(cfg *aws.Config,
 	return creds, nil
 }
 
+func resolveSSOCredentials(cfg *aws.Config, sharedCfg sharedConfig, handlers request.Handlers) (*credentials.Credentials, error) {
+	if err := sharedCfg.validateSSOConfiguration(); err != nil {
+		return nil, err
+	}
+
+	cfgCopy := cfg.Copy()
+	cfgCopy.Region = &sharedCfg.SSORegion
+
+	return ssocreds.NewCredentials(
+		&Session{
+			Config:   cfgCopy,
+			Handlers: handlers.Copy(),
+		},
+		sharedCfg.SSOAccountID,
+		sharedCfg.SSORoleName,
+		sharedCfg.SSOStartURL,
+	), nil
+}
+
 // valid credential source values
 const (
 	credSourceEc2Metadata  = "Ec2InstanceMetadata"

vendor/github.com/aws/aws-sdk-go/aws/session/session.go

@@ -36,7 +36,7 @@ const (
 
 // ErrSharedConfigSourceCollision will be returned if a section contains both
 // source_profile and credential_source
-var ErrSharedConfigSourceCollision = awserr.New(ErrCodeSharedConfig, "only source profile or credential source can be specified, not both", nil)
+var ErrSharedConfigSourceCollision = awserr.New(ErrCodeSharedConfig, "only one credential type may be specified per profile: source profile, credential source, credential process, web identity token, or sso", nil)
 
 // ErrSharedConfigECSContainerEnvVarEmpty will be returned if the environment
 // variables are empty and Environment was set as the credential source

vendor/github.com/aws/aws-sdk-go/aws/session/shared_config.go

@@ -2,6 +2,7 @@ package session
 
 import (
 	"fmt"
+	"strings"
 	"time"
 
 	"github.com/aws/aws-sdk-go/aws/awserr"
@@ -25,6 +26,12 @@ const (
 	roleSessionNameKey     = `role_session_name` // optional
 	roleDurationSecondsKey = "duration_seconds"  // optional
 
+	// AWS Single Sign-On (AWS SSO) group
+	ssoAccountIDKey = "sso_account_id"
+	ssoRegionKey    = "sso_region"
+	ssoRoleNameKey  = "sso_role_name"
+	ssoStartURL     = "sso_start_url"
+
 	// CSM options
 	csmEnabledKey  = `csm_enabled`
 	csmHostKey     = `csm_host`
@@ -63,6 +70,8 @@ const (
 
 // sharedConfig represents the configuration fields of the SDK config files.
 type sharedConfig struct {
+	Profile string
+
 	// Credentials values from the config file. Both aws_access_key_id and
 	// aws_secret_access_key must be provided together in the same file to be
 	// considered valid. The values will be ignored if not a complete group.
@@ -78,6 +87,11 @@ type sharedConfig struct {
 	CredentialProcess    string
 	WebIdentityTokenFile string
 
+	SSOAccountID string
+	SSORegion    string
+	SSORoleName  string
+	SSOStartURL  string
+
 	RoleARN            string
 	RoleSessionName    string
 	ExternalID         string
@@ -189,6 +203,8 @@ func loadSharedConfigIniFiles(filenames []string) ([]sharedConfigFile, error) {
 }
 
 func (cfg *sharedConfig) setFromIniFiles(profiles map[string]struct{}, profile string, files []sharedConfigFile, exOpts bool) error {
+	cfg.Profile = profile
+
 	// Trim files from the list that don't exist.
 	var skippedFiles int
 	var profileNotFoundErr error
@@ -217,9 +233,9 @@ func (cfg *sharedConfig) setFromIniFiles(profiles map[string]struct{}, profile s
 		cfg.clearAssumeRoleOptions()
 	} else {
 		// First time a profile has been seen, It must either be a assume role
-		// or credentials. Assert if the credential type requires a role ARN,
-		// the ARN is also set.
-		if err := cfg.validateCredentialsRequireARN(profile); err != nil {
+		// credentials, or SSO. Assert if the credential type requires a role ARN,
+		// the ARN is also set, or validate that the SSO configuration is complete.
+		if err := cfg.validateCredentialsConfig(profile); err != nil {
 			return err
 		}
 	}
@@ -312,6 +328,12 @@ func (cfg *sharedConfig) setFromIniFile(profile string, file sharedConfigFile, e
 			}
 			cfg.S3UsEast1RegionalEndpoint = sre
 		}
+
+		// AWS Single Sign-On (AWS SSO)
+		updateString(&cfg.SSOAccountID, section, ssoAccountIDKey)
+		updateString(&cfg.SSORegion, section, ssoRegionKey)
+		updateString(&cfg.SSORoleName, section, ssoRoleNameKey)
+		updateString(&cfg.SSOStartURL, section, ssoStartURL)
 	}
 
 	updateString(&cfg.CredentialProcess, section, credentialProcessKey)
@@ -342,6 +364,14 @@ func (cfg *sharedConfig) setFromIniFile(profile string, file sharedConfigFile, e
 	return nil
 }
 
+func (cfg *sharedConfig) validateCredentialsConfig(profile string) error {
+	if err := cfg.validateCredentialsRequireARN(profile); err != nil {
+		return err
+	}
+
+	return nil
+}
+
 func (cfg *sharedConfig) validateCredentialsRequireARN(profile string) error {
 	var credSource string
 
@@ -378,12 +408,43 @@ func (cfg *sharedConfig) validateCredentialType() error {
 	return nil
 }
 
+func (cfg *sharedConfig) validateSSOConfiguration() error {
+	if !cfg.hasSSOConfiguration() {
+		return nil
+	}
+
+	var missing []string
+	if len(cfg.SSOAccountID) == 0 {
+		missing = append(missing, ssoAccountIDKey)
+	}
+
+	if len(cfg.SSORegion) == 0 {
+		missing = append(missing, ssoRegionKey)
+	}
+
+	if len(cfg.SSORoleName) == 0 {
+		missing = append(missing, ssoRoleNameKey)
+	}
+
+	if len(cfg.SSOStartURL) == 0 {
+		missing = append(missing, ssoStartURL)
+	}
+
+	if len(missing) > 0 {
+		return fmt.Errorf("profile %q is configured to use SSO but is missing required configuration: %s",
+			cfg.Profile, strings.Join(missing, ", "))
+	}
+
+	return nil
+}
+
 func (cfg *sharedConfig) hasCredentials() bool {
 	switch {
 	case len(cfg.SourceProfileName) != 0:
 	case len(cfg.CredentialSource) != 0:
 	case len(cfg.CredentialProcess) != 0:
 	case len(cfg.WebIdentityTokenFile) != 0:
+	case cfg.hasSSOConfiguration():
 	case cfg.Creds.HasKeys():
 	default:
 		return false
@@ -397,6 +458,10 @@ func (cfg *sharedConfig) clearCredentialOptions() {
 	cfg.CredentialProcess = ""
 	cfg.WebIdentityTokenFile = ""
 	cfg.Creds = credentials.Value{}
+	cfg.SSOAccountID = ""
+	cfg.SSORegion = ""
+	cfg.SSORoleName = ""
+	cfg.SSOStartURL = ""
 }
 
 func (cfg *sharedConfig) clearAssumeRoleOptions() {
@@ -407,6 +472,18 @@ func (cfg *sharedConfig) clearAssumeRoleOptions() {
 	cfg.SourceProfileName = ""
 }
 
+func (cfg *sharedConfig) hasSSOConfiguration() bool {
+	switch {
+	case len(cfg.SSOAccountID) != 0:
+	case len(cfg.SSORegion) != 0:
+	case len(cfg.SSORoleName) != 0:
+	case len(cfg.SSOStartURL) != 0:
+	default:
+		return false
+	}
+	return true
+}
+
 func oneOrNone(bs ...bool) bool {
 	var count int
 

vendor/github.com/aws/aws-sdk-go/aws/signer/v4/header_rules.go

@@ -34,23 +34,23 @@ func (m mapRule) IsValid(value string) bool {
 	return ok
 }
 
-// whitelist is a generic rule for whitelisting
-type whitelist struct {
+// allowList is a generic rule for allow listing
+type allowList struct {
 	rule
 }
 
-// IsValid for whitelist checks if the value is within the whitelist
-func (w whitelist) IsValid(value string) bool {
+// IsValid for allow list checks if the value is within the allow list
+func (w allowList) IsValid(value string) bool {
 	return w.rule.IsValid(value)
 }
 
-// blacklist is a generic rule for blacklisting
-type blacklist struct {
+// excludeList is a generic rule for blacklisting
+type excludeList struct {
 	rule
 }
 
-// IsValid for whitelist checks if the value is within the whitelist
-func (b blacklist) IsValid(value string) bool {
+// IsValid for allow list checks if the value is within the allow list
+func (b excludeList) IsValid(value string) bool {
 	return !b.rule.IsValid(value)
 }
 

vendor/github.com/aws/aws-sdk-go/aws/signer/v4/v4.go

@@ -90,7 +90,7 @@ const (
 )
 
 var ignoredHeaders = rules{
-	blacklist{
+	excludeList{
 		mapRule{
 			authorizationHeader: struct{}{},
 			"User-Agent":        struct{}{},
@@ -99,9 +99,9 @@ var ignoredHeaders = rules{
 	},
 }
 
-// requiredSignedHeaders is a whitelist for build canonical headers.
+// requiredSignedHeaders is a allow list for build canonical headers.
 var requiredSignedHeaders = rules{
-	whitelist{
+	allowList{
 		mapRule{
 			"Cache-Control":                         struct{}{},
 			"Content-Disposition":                   struct{}{},
@@ -145,12 +145,13 @@ var requiredSignedHeaders = rules{
 		},
 	},
 	patterns{"X-Amz-Meta-"},
+	patterns{"X-Amz-Object-Lock-"},
 }
 
-// allowedHoisting is a whitelist for build query headers. The boolean value
+// allowedHoisting is a allow list for build query headers. The boolean value
 // represents whether or not it is a pattern.
 var allowedQueryHoisting = inclusiveRules{
-	blacklist{requiredSignedHeaders},
+	excludeList{requiredSignedHeaders},
 	patterns{"X-Amz-"},
 }
 
@@ -689,9 +690,12 @@ func (ctx *signingCtx) buildBodyDigest() error {
 	if hash == "" {
 		includeSHA256Header := ctx.unsignedPayload ||
 			ctx.ServiceName == "s3" ||
+			ctx.ServiceName == "s3-object-lambda" ||
 			ctx.ServiceName == "glacier"
 
-		s3Presign := ctx.isPresign && ctx.ServiceName == "s3"
+		s3Presign := ctx.isPresign &&
+			(ctx.ServiceName == "s3" ||
+				ctx.ServiceName == "s3-object-lambda")
 
 		if ctx.unsignedPayload || s3Presign {
 			hash = "UNSIGNED-PAYLOAD"

vendor/github.com/aws/aws-sdk-go/aws/version.go

@@ -5,4 +5,4 @@ package aws
 const SDKName = "aws-sdk-go"
 
 // SDKVersion is the version of this SDK
-const SDKVersion = "1.36.31"
+const SDKVersion = "1.39.0"

vendor/github.com/aws/aws-sdk-go/internal/ini/doc.go

@@ -13,17 +13,30 @@
 //	}
 //
 // Below is the BNF that describes this parser
-//	Grammar:
-//	stmt -> value stmt'
-//	stmt' -> epsilon | op stmt
-//	value -> number | string | boolean | quoted_string
+//  Grammar:
+//  stmt -> section | stmt'
+//  stmt' -> epsilon | expr
+//  expr -> value (stmt)* | equal_expr (stmt)*
+//  equal_expr -> value ( ':' | '=' ) equal_expr'
+//  equal_expr' -> number | string | quoted_string
+//  quoted_string -> " quoted_string'
+//  quoted_string' -> string quoted_string_end
+//  quoted_string_end -> "
 //
-//	section -> [ section'
-//	section' -> value section_close
-//	section_close -> ]
+//  section -> [ section'
+//  section' -> section_value section_close
+//  section_value -> number | string_subset | boolean | quoted_string_subset
+//  quoted_string_subset -> " quoted_string_subset'
+//  quoted_string_subset' -> string_subset quoted_string_end
+//  quoted_string_subset -> "
+//  section_close -> ]
 //
-//	SkipState will skip (NL WS)+
+//  value -> number | string_subset | boolean
+//  string -> ? UTF-8 Code-Points except '\n' (U+000A) and '\r\n' (U+000D U+000A) ?
+//  string_subset -> ? Code-points excepted by <string> grammar except ':' (U+003A), '=' (U+003D), '[' (U+005B), and ']' (U+005D) ?
 //
-//	comment -> # comment' | ; comment'
-//	comment' -> epsilon | value
+//  SkipState will skip (NL WS)+
+//
+//  comment -> # comment' | ; comment'
+//  comment' -> epsilon | value
 package ini

vendor/github.com/aws/aws-sdk-go/internal/ini/ini_parser.go

@@ -5,9 +5,12 @@ import (
 	"io"
 )
 
+// ParseState represents the current state of the parser.
+type ParseState uint
+
 // State enums for the parse table
 const (
-	InvalidState = iota
+	InvalidState ParseState = iota
 	// stmt -> value stmt'
 	StatementState
 	// stmt' -> MarkComplete | op stmt
@@ -36,8 +39,8 @@ const (
 )
 
 // parseTable is a state machine to dictate the grammar above.
-var parseTable = map[ASTKind]map[TokenType]int{
-	ASTKindStart: map[TokenType]int{
+var parseTable = map[ASTKind]map[TokenType]ParseState{
+	ASTKindStart: {
 		TokenLit:     StatementState,
 		TokenSep:     OpenScopeState,
 		TokenWS:      SkipTokenState,
@@ -45,7 +48,7 @@ var parseTable = map[ASTKind]map[TokenType]int{
 		TokenComment: CommentState,
 		TokenNone:    TerminalState,
 	},
-	ASTKindCommentStatement: map[TokenType]int{
+	ASTKindCommentStatement: {
 		TokenLit:     StatementState,
 		TokenSep:     OpenScopeState,
 		TokenWS:      SkipTokenState,
@@ -53,7 +56,7 @@ var parseTable = map[ASTKind]map[TokenType]int{
 		TokenComment: CommentState,
 		TokenNone:    MarkCompleteState,
 	},
-	ASTKindExpr: map[TokenType]int{
+	ASTKindExpr: {
 		TokenOp:      StatementPrimeState,
 		TokenLit:     ValueState,
 		TokenSep:     OpenScopeState,
@@ -62,13 +65,15 @@ var parseTable = map[ASTKind]map[TokenType]int{
 		TokenComment: CommentState,
 		TokenNone:    MarkCompleteState,
 	},
-	ASTKindEqualExpr: map[TokenType]int{
-		TokenLit:     ValueState,
-		TokenWS:      SkipTokenState,
-		TokenNL:      SkipState,
-		TokenNone:    SkipState,
+	ASTKindEqualExpr: {
+		TokenLit:  ValueState,
+		TokenSep:  ValueState,
+		TokenOp:   ValueState,
+		TokenWS:   SkipTokenState,
+		TokenNL:   SkipState,
+		TokenNone: SkipState,
 	},
-	ASTKindStatement: map[TokenType]int{
+	ASTKindStatement: {
 		TokenLit:     SectionState,
 		TokenSep:     CloseScopeState,
 		TokenWS:      SkipTokenState,
@@ -76,9 +81,9 @@ var parseTable = map[ASTKind]map[TokenType]int{
 		TokenComment: CommentState,
 		TokenNone:    MarkCompleteState,
 	},
-	ASTKindExprStatement: map[TokenType]int{
+	ASTKindExprStatement: {
 		TokenLit:     ValueState,
-		TokenSep:     OpenScopeState,
+		TokenSep:     ValueState,
 		TokenOp:      ValueState,
 		TokenWS:      ValueState,
 		TokenNL:      MarkCompleteState,
@@ -86,14 +91,14 @@ var parseTable = map[ASTKind]map[TokenType]int{
 		TokenNone:    TerminalState,
 		TokenComma:   SkipState,
 	},
-	ASTKindSectionStatement: map[TokenType]int{
+	ASTKindSectionStatement: {
 		TokenLit: SectionState,
 		TokenOp:  SectionState,
 		TokenSep: CloseScopeState,
 		TokenWS:  SectionState,
 		TokenNL:  SkipTokenState,
 	},
-	ASTKindCompletedSectionStatement: map[TokenType]int{
+	ASTKindCompletedSectionStatement: {
 		TokenWS:      SkipTokenState,
 		TokenNL:      SkipTokenState,
 		TokenLit:     StatementState,
@@ -101,7 +106,7 @@ var parseTable = map[ASTKind]map[TokenType]int{
 		TokenComment: CommentState,
 		TokenNone:    MarkCompleteState,
 	},
-	ASTKindSkipStatement: map[TokenType]int{
+	ASTKindSkipStatement: {
 		TokenLit:     StatementState,
 		TokenSep:     OpenScopeState,
 		TokenWS:      SkipTokenState,
@@ -205,18 +210,6 @@ loop:
 		case ValueState:
 			// ValueState requires the previous state to either be an equal expression
 			// or an expression statement.
-			//
-			// This grammar occurs when the RHS is a number, word, or quoted string.
-			// equal_expr -> lit op equal_expr'
-			// equal_expr' -> number | string | quoted_string
-			// quoted_string -> " quoted_string'
-			// quoted_string' -> string quoted_string_end
-			// quoted_string_end -> "
-			//
-			// otherwise
-			// expr_stmt -> equal_expr (expr_stmt')*
-			// expr_stmt' -> ws S | op S | MarkComplete
-			// S -> equal_expr' expr_stmt'
 			switch k.Kind {
 			case ASTKindEqualExpr:
 				// assigning a value to some key
@@ -243,7 +236,7 @@ loop:
 				}
 
 				children[len(children)-1] = rhs
-				k.SetChildren(children)
+				root.SetChildren(children)
 
 				stack.Push(k)
 			}

vendor/github.com/aws/aws-sdk-go/internal/ini/visitor.go

@@ -50,7 +50,10 @@ func (v *DefaultVisitor) VisitExpr(expr AST) error {
 
 			rhs := children[1]
 
-			if rhs.Root.Type() != TokenLit {
+			// The right-hand value side the equality expression is allowed to contain '[', ']', ':', '=' in the values.
+			// If the token is not either a literal or one of the token types that identifies those four additional
+			// tokens then error.
+			if !(rhs.Root.Type() == TokenLit || rhs.Root.Type() == TokenOp || rhs.Root.Type() == TokenSep) {
 				return NewParseError("unexpected token type")
 			}
 

vendor/github.com/aws/aws-sdk-go/internal/s3shared/arn/arn.go

@@ -7,6 +7,21 @@ import (
 	"github.com/aws/aws-sdk-go/aws/arn"
 )
 
+var supportedServiceARN = []string{
+	"s3",
+	"s3-outposts",
+	"s3-object-lambda",
+}
+
+func isSupportedServiceARN(service string) bool {
+	for _, name := range supportedServiceARN {
+		if name == service {
+			return true
+		}
+	}
+	return false
+}
+
 // Resource provides the interfaces abstracting ARNs of specific resource
 // types.
 type Resource interface {
@@ -29,9 +44,14 @@ func ParseResource(s string, resParser ResourceParser) (resARN Resource, err err
 		return nil, InvalidARNError{ARN: a, Reason: "partition not set"}
 	}
 
-	if a.Service != "s3" && a.Service != "s3-outposts" {
+	if !isSupportedServiceARN(a.Service) {
 		return nil, InvalidARNError{ARN: a, Reason: "service is not supported"}
 	}
+
+	if strings.HasPrefix(a.Region, "fips-") || strings.HasSuffix(a.Region, "-fips") {
+		return nil, InvalidARNError{ARN: a, Reason: "FIPS region not allowed in ARN"}
+	}
+
 	if len(a.Resource) == 0 {
 		return nil, InvalidARNError{ARN: a, Reason: "resource not set"}
 	}

vendor/github.com/aws/aws-sdk-go/internal/s3shared/arn/s3_object_lambda_arn.go

@@ -0,0 +1,15 @@
+package arn
+
+// S3ObjectLambdaARN represents an ARN for the s3-object-lambda service
+type S3ObjectLambdaARN interface {
+	Resource
+
+	isS3ObjectLambdasARN()
+}
+
+// S3ObjectLambdaAccessPointARN is an S3ObjectLambdaARN for the Access Point resource type
+type S3ObjectLambdaAccessPointARN struct {
+	AccessPointARN
+}
+
+func (s S3ObjectLambdaAccessPointARN) isS3ObjectLambdasARN() {}

vendor/github.com/aws/aws-sdk-go/internal/s3shared/endpoint_errors.go

@@ -71,6 +71,8 @@ func NewInvalidARNWithUnsupportedPartitionError(resource arn.Resource, err error
 }
 
 // NewInvalidARNWithFIPSError ARN not supported for FIPS region
+//
+// Deprecated: FIPS will not appear in the ARN region component.
 func NewInvalidARNWithFIPSError(resource arn.Resource, err error) InvalidARNError {
 	return InvalidARNError{
 		message:  "resource ARN not supported for FIPS region",
@@ -155,6 +157,17 @@ func NewClientConfiguredForFIPSError(resource arn.Resource, clientPartitionID, c
 	}
 }
 
+// NewFIPSConfigurationError denotes a configuration error when a client or request is configured for FIPS
+func NewFIPSConfigurationError(resource arn.Resource, clientPartitionID, clientRegion string, err error) ConfigurationError {
+	return ConfigurationError{
+		message:           "use of ARN is not supported when client or request is configured for FIPS",
+		origErr:           err,
+		resource:          resource,
+		clientPartitionID: clientPartitionID,
+		clientRegion:      clientRegion,
+	}
+}
+
 // NewClientConfiguredForAccelerateError denotes client config error for unsupported S3 accelerate
 func NewClientConfiguredForAccelerateError(resource arn.Resource, clientPartitionID, clientRegion string, err error) ConfigurationError {
 	return ConfigurationError{

vendor/github.com/aws/aws-sdk-go/internal/s3shared/resource_request.go

@@ -31,6 +31,8 @@ func (r ResourceRequest) UseFIPS() bool {
 }
 
 // ResourceConfiguredForFIPS returns true if resource ARNs region is FIPS
+//
+// Deprecated: FIPS pseudo-regions will not be in the ARN
 func (r ResourceRequest) ResourceConfiguredForFIPS() bool {
 	return IsFIPS(r.ARN().Region)
 }

vendor/github.com/aws/aws-sdk-go/private/protocol/eventstream/eventstreamapi/error.go

@@ -5,6 +5,10 @@ import (
 	"sync"
 )
 
+// InputWriterCloseErrorCode is used to denote an error occurred
+// while closing the event stream input writer.
+const InputWriterCloseErrorCode = "EventStreamInputWriterCloseError"
+
 type messageError struct {
 	code string
 	msg  string

vendor/github.com/aws/aws-sdk-go/private/protocol/eventstream/eventstreamapi/writer.go

@@ -61,49 +61,3 @@ func (w *EventWriter) marshal(event Marshaler) (eventstream.Message, error) {
 	msg.Headers.Set(EventTypeHeader, eventstream.StringValue(eventType))
 	return msg, nil
 }
-
-//type EventEncoder struct {
-//	encoder           Encoder
-//	ppayloadMarshaler protocol.PayloadMarshaler
-//	eventTypeFor      func(Marshaler) (string, error)
-//}
-//
-//func (e EventEncoder) Encode(event Marshaler) error {
-//	msg, err := e.marshal(event)
-//	if err != nil {
-//		return err
-//	}
-//
-//	return w.encoder.Encode(msg)
-//}
-//
-//func (e EventEncoder) marshal(event Marshaler) (eventstream.Message, error) {
-//	eventType, err := w.eventTypeFor(event)
-//	if err != nil {
-//		return eventstream.Message{}, err
-//	}
-//
-//	msg, err := event.MarshalEvent(w.payloadMarshaler)
-//	if err != nil {
-//		return eventstream.Message{}, err
-//	}
-//
-//	msg.Headers.Set(EventTypeHeader, eventstream.StringValue(eventType))
-//	return msg, nil
-//}
-//
-//func (w *EventWriter) marshal(event Marshaler) (eventstream.Message, error) {
-//	eventType, err := w.eventTypeFor(event)
-//	if err != nil {
-//		return eventstream.Message{}, err
-//	}
-//
-//	msg, err := event.MarshalEvent(w.payloadMarshaler)
-//	if err != nil {
-//		return eventstream.Message{}, err
-//	}
-//
-//	msg.Headers.Set(EventTypeHeader, eventstream.StringValue(eventType))
-//	return msg, nil
-//}
-//

vendor/github.com/aws/aws-sdk-go/private/protocol/rest/build.go

@@ -98,7 +98,7 @@ func buildLocationElements(r *request.Request, v reflect.Value, buildGETQuery bo
 
 			// Support the ability to customize values to be marshaled as a
 			// blob even though they were modeled as a string. Required for S3
-			// API operations like SSECustomerKey is modeled as stirng but
+			// API operations like SSECustomerKey is modeled as string but
 			// required to be base64 encoded in request.
 			if field.Tag.Get("marshal-as") == "blob" {
 				m = m.Convert(byteSliceType)

vendor/github.com/aws/aws-sdk-go/private/protocol/restjson/restjson.go

@@ -0,0 +1,59 @@
+// Package restjson provides RESTful JSON serialization of AWS
+// requests and responses.
+package restjson
+
+//go:generate go run -tags codegen ../../../private/model/cli/gen-protocol-tests ../../../models/protocol_tests/input/rest-json.json build_test.go
+//go:generate go run -tags codegen ../../../private/model/cli/gen-protocol-tests ../../../models/protocol_tests/output/rest-json.json unmarshal_test.go
+
+import (
+	"github.com/aws/aws-sdk-go/aws/request"
+	"github.com/aws/aws-sdk-go/private/protocol/jsonrpc"
+	"github.com/aws/aws-sdk-go/private/protocol/rest"
+)
+
+// BuildHandler is a named request handler for building restjson protocol
+// requests
+var BuildHandler = request.NamedHandler{
+	Name: "awssdk.restjson.Build",
+	Fn:   Build,
+}
+
+// UnmarshalHandler is a named request handler for unmarshaling restjson
+// protocol requests
+var UnmarshalHandler = request.NamedHandler{
+	Name: "awssdk.restjson.Unmarshal",
+	Fn:   Unmarshal,
+}
+
+// UnmarshalMetaHandler is a named request handler for unmarshaling restjson
+// protocol request metadata
+var UnmarshalMetaHandler = request.NamedHandler{
+	Name: "awssdk.restjson.UnmarshalMeta",
+	Fn:   UnmarshalMeta,
+}
+
+// Build builds a request for the REST JSON protocol.
+func Build(r *request.Request) {
+	rest.Build(r)
+
+	if t := rest.PayloadType(r.Params); t == "structure" || t == "" {
+		if v := r.HTTPRequest.Header.Get("Content-Type"); len(v) == 0 {
+			r.HTTPRequest.Header.Set("Content-Type", "application/json")
+		}
+		jsonrpc.Build(r)
+	}
+}
+
+// Unmarshal unmarshals a response body for the REST JSON protocol.
+func Unmarshal(r *request.Request) {
+	if t := rest.PayloadType(r.Data); t == "structure" || t == "" {
+		jsonrpc.Unmarshal(r)
+	} else {
+		rest.Unmarshal(r)
+	}
+}
+
+// UnmarshalMeta unmarshals response headers for the REST JSON protocol.
+func UnmarshalMeta(r *request.Request) {
+	rest.UnmarshalMeta(r)
+}

vendor/github.com/aws/aws-sdk-go/private/protocol/restjson/unmarshal_error.go

@@ -0,0 +1,134 @@
+package restjson
+
+import (
+	"bytes"
+	"io"
+	"io/ioutil"
+	"net/http"
+	"strings"
+
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/aws/request"
+	"github.com/aws/aws-sdk-go/private/protocol"
+	"github.com/aws/aws-sdk-go/private/protocol/json/jsonutil"
+	"github.com/aws/aws-sdk-go/private/protocol/rest"
+)
+
+const (
+	errorTypeHeader    = "X-Amzn-Errortype"
+	errorMessageHeader = "X-Amzn-Errormessage"
+)
+
+// UnmarshalTypedError provides unmarshaling errors API response errors
+// for both typed and untyped errors.
+type UnmarshalTypedError struct {
+	exceptions map[string]func(protocol.ResponseMetadata) error
+}
+
+// NewUnmarshalTypedError returns an UnmarshalTypedError initialized for the
+// set of exception names to the error unmarshalers
+func NewUnmarshalTypedError(exceptions map[string]func(protocol.ResponseMetadata) error) *UnmarshalTypedError {
+	return &UnmarshalTypedError{
+		exceptions: exceptions,
+	}
+}
+
+// UnmarshalError attempts to unmarshal the HTTP response error as a known
+// error type. If unable to unmarshal the error type, the generic SDK error
+// type will be used.
+func (u *UnmarshalTypedError) UnmarshalError(
+	resp *http.Response,
+	respMeta protocol.ResponseMetadata,
+) (error, error) {
+
+	code := resp.Header.Get(errorTypeHeader)
+	msg := resp.Header.Get(errorMessageHeader)
+
+	body := resp.Body
+	if len(code) == 0 {
+		// If unable to get code from HTTP headers have to parse JSON message
+		// to determine what kind of exception this will be.
+		var buf bytes.Buffer
+		var jsonErr jsonErrorResponse
+		teeReader := io.TeeReader(resp.Body, &buf)
+		err := jsonutil.UnmarshalJSONError(&jsonErr, teeReader)
+		if err != nil {
+			return nil, err
+		}
+
+		body = ioutil.NopCloser(&buf)
+		code = jsonErr.Code
+		msg = jsonErr.Message
+	}
+
+	// If code has colon separators remove them so can compare against modeled
+	// exception names.
+	code = strings.SplitN(code, ":", 2)[0]
+
+	if fn, ok := u.exceptions[code]; ok {
+		// If exception code is know, use associated constructor to get a value
+		// for the exception that the JSON body can be unmarshaled into.
+		v := fn(respMeta)
+		if err := jsonutil.UnmarshalJSONCaseInsensitive(v, body); err != nil {
+			return nil, err
+		}
+
+		if err := rest.UnmarshalResponse(resp, v, true); err != nil {
+			return nil, err
+		}
+
+		return v, nil
+	}
+
+	// fallback to unmodeled generic exceptions
+	return awserr.NewRequestFailure(
+		awserr.New(code, msg, nil),
+		respMeta.StatusCode,
+		respMeta.RequestID,
+	), nil
+}
+
+// UnmarshalErrorHandler is a named request handler for unmarshaling restjson
+// protocol request errors
+var UnmarshalErrorHandler = request.NamedHandler{
+	Name: "awssdk.restjson.UnmarshalError",
+	Fn:   UnmarshalError,
+}
+
+// UnmarshalError unmarshals a response error for the REST JSON protocol.
+func UnmarshalError(r *request.Request) {
+	defer r.HTTPResponse.Body.Close()
+
+	var jsonErr jsonErrorResponse
+	err := jsonutil.UnmarshalJSONError(&jsonErr, r.HTTPResponse.Body)
+	if err != nil {
+		r.Error = awserr.NewRequestFailure(
+			awserr.New(request.ErrCodeSerialization,
+				"failed to unmarshal response error", err),
+			r.HTTPResponse.StatusCode,
+			r.RequestID,
+		)
+		return
+	}
+
+	code := r.HTTPResponse.Header.Get(errorTypeHeader)
+	if code == "" {
+		code = jsonErr.Code
+	}
+	msg := r.HTTPResponse.Header.Get(errorMessageHeader)
+	if msg == "" {
+		msg = jsonErr.Message
+	}
+
+	code = strings.SplitN(code, ":", 2)[0]
+	r.Error = awserr.NewRequestFailure(
+		awserr.New(code, jsonErr.Message, nil),
+		r.HTTPResponse.StatusCode,
+		r.RequestID,
+	)
+}
+
+type jsonErrorResponse struct {
+	Code    string `json:"code"`
+	Message string `json:"message"`
+}

vendor/github.com/aws/aws-sdk-go/private/protocol/timestamp.go

@@ -1,6 +1,8 @@
 package protocol
 
 import (
+	"bytes"
+	"fmt"
 	"math"
 	"strconv"
 	"time"
@@ -19,7 +21,9 @@ const (
 // Output time is intended to not contain decimals
 const (
 	// RFC 7231#section-7.1.1.1 timetamp format. e.g Tue, 29 Apr 2014 18:30:38 GMT
-	RFC822TimeFormat = "Mon, 2 Jan 2006 15:04:05 GMT"
+	RFC822TimeFormat                           = "Mon, 2 Jan 2006 15:04:05 GMT"
+	rfc822TimeFormatSingleDigitDay             = "Mon, _2 Jan 2006 15:04:05 GMT"
+	rfc822TimeFormatSingleDigitDayTwoDigitYear = "Mon, _2 Jan 06 15:04:05 GMT"
 
 	// This format is used for output time without seconds precision
 	RFC822OutputTimeFormat = "Mon, 02 Jan 2006 15:04:05 GMT"
@@ -67,10 +71,20 @@ func FormatTime(name string, t time.Time) string {
 // the time if it was able to be parsed, and fails otherwise.
 func ParseTime(formatName, value string) (time.Time, error) {
 	switch formatName {
-	case RFC822TimeFormatName:
-		return time.Parse(RFC822TimeFormat, value)
-	case ISO8601TimeFormatName:
-		return time.Parse(ISO8601TimeFormat, value)
+	case RFC822TimeFormatName: // Smithy HTTPDate format
+		return tryParse(value,
+			RFC822TimeFormat,
+			rfc822TimeFormatSingleDigitDay,
+			rfc822TimeFormatSingleDigitDayTwoDigitYear,
+			time.RFC850,
+			time.ANSIC,
+		)
+	case ISO8601TimeFormatName: // Smithy DateTime format
+		return tryParse(value,
+			ISO8601TimeFormat,
+			time.RFC3339Nano,
+			time.RFC3339,
+		)
 	case UnixTimeFormatName:
 		v, err := strconv.ParseFloat(value, 64)
 		_, dec := math.Modf(v)
@@ -83,3 +97,36 @@ func ParseTime(formatName, value string) (time.Time, error) {
 		panic("unknown timestamp format name, " + formatName)
 	}
 }
+
+func tryParse(v string, formats ...string) (time.Time, error) {
+	var errs parseErrors
+	for _, f := range formats {
+		t, err := time.Parse(f, v)
+		if err != nil {
+			errs = append(errs, parseError{
+				Format: f,
+				Err:    err,
+			})
+			continue
+		}
+		return t, nil
+	}
+
+	return time.Time{}, fmt.Errorf("unable to parse time string, %v", errs)
+}
+
+type parseErrors []parseError
+
+func (es parseErrors) Error() string {
+	var s bytes.Buffer
+	for _, e := range es {
+		fmt.Fprintf(&s, "\n * %q: %v", e.Format, e.Err)
+	}
+
+	return "parse errors:" + s.String()
+}
+
+type parseError struct {
+	Format string
+	Err    error
+}

vendor/github.com/aws/aws-sdk-go/private/protocol/xml/xmlutil/build.go

@@ -308,6 +308,8 @@ func (b *xmlBuilder) buildScalar(value reflect.Value, current *XMLNode, tag refl
 	if tag.Get("xmlAttribute") != "" { // put into current node's attribute list
 		attr := xml.Attr{Name: xname, Value: str}
 		current.Attr = append(current.Attr, attr)
+	} else if len(xname.Local) == 0 {
+		current.Text = str
 	} else { // regular text node
 		current.AddChild(&XMLNode{Name: xname, Text: str})
 	}

vendor/github.com/aws/aws-sdk-go/private/protocol/xml/xmlutil/xml_to_struct.go

@@ -18,6 +18,14 @@ type XMLNode struct {
 	parent     *XMLNode
 }
 
+// textEncoder is a string type alias that implemnts the TextMarshaler interface.
+// This alias type is used to ensure that the line feed (\n) (U+000A) is escaped.
+type textEncoder string
+
+func (t textEncoder) MarshalText() ([]byte, error) {
+	return []byte(t), nil
+}
+
 // NewXMLElement returns a pointer to a new XMLNode initialized to default values.
 func NewXMLElement(name xml.Name) *XMLNode {
 	return &XMLNode{
@@ -130,11 +138,16 @@ func StructToXML(e *xml.Encoder, node *XMLNode, sorted bool) error {
 		attrs = sortedAttrs
 	}
 
-	e.EncodeToken(xml.StartElement{Name: node.Name, Attr: attrs})
+	startElement := xml.StartElement{Name: node.Name, Attr: attrs}
 
 	if node.Text != "" {
-		e.EncodeToken(xml.CharData([]byte(node.Text)))
-	} else if sorted {
+		e.EncodeElement(textEncoder(node.Text), startElement)
+		return e.Flush()
+	}
+
+	e.EncodeToken(startElement)
+
+	if sorted {
 		sortedNames := []string{}
 		for k := range node.Children {
 			sortedNames = append(sortedNames, k)
@@ -154,6 +167,7 @@ func StructToXML(e *xml.Encoder, node *XMLNode, sorted bool) error {
 		}
 	}
 
-	e.EncodeToken(xml.EndElement{Name: node.Name})
+	e.EncodeToken(startElement.End())
+
 	return e.Flush()
 }

vendor/github.com/aws/aws-sdk-go/service/acm/api.go

@@ -104,6 +104,9 @@ func (c *ACM) AddTagsToCertificateRequest(input *AddTagsToCertificateInput) (req
 //   * InvalidParameterException
 //   An input parameter was invalid.
 //
+//   * ThrottlingException
+//   The request was denied because it exceeded a quota.
+//
 // See also, https://docs.aws.amazon.com/goto/WebAPI/acm-2015-12-08/AddTagsToCertificate
 func (c *ACM) AddTagsToCertificate(input *AddTagsToCertificateInput) (*AddTagsToCertificateOutput, error) {
 	req, out := c.AddTagsToCertificateRequest(input)
@@ -399,6 +402,88 @@ func (c *ACM) ExportCertificateWithContext(ctx aws.Context, input *ExportCertifi
 	return out, req.Send()
 }
 
+const opGetAccountConfiguration = "GetAccountConfiguration"
+
+// GetAccountConfigurationRequest generates a "aws/request.Request" representing the
+// client's request for the GetAccountConfiguration operation. The "output" return
+// value will be populated with the request's response once the request completes
+// successfully.
+//
+// Use "Send" method on the returned Request to send the API call to the service.
+// the "output" return value is not valid until after Send returns without error.
+//
+// See GetAccountConfiguration for more information on using the GetAccountConfiguration
+// API call, and error handling.
+//
+// This method is useful when you want to inject custom logic or configuration
+// into the SDK's request lifecycle. Such as custom headers, or retry logic.
+//
+//
+//    // Example sending a request using the GetAccountConfigurationRequest method.
+//    req, resp := client.GetAccountConfigurationRequest(params)
+//
+//    err := req.Send()
+//    if err == nil { // resp is now filled
+//        fmt.Println(resp)
+//    }
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/acm-2015-12-08/GetAccountConfiguration
+func (c *ACM) GetAccountConfigurationRequest(input *GetAccountConfigurationInput) (req *request.Request, output *GetAccountConfigurationOutput) {
+	op := &request.Operation{
+		Name:       opGetAccountConfiguration,
+		HTTPMethod: "POST",
+		HTTPPath:   "/",
+	}
+
+	if input == nil {
+		input = &GetAccountConfigurationInput{}
+	}
+
+	output = &GetAccountConfigurationOutput{}
+	req = c.newRequest(op, input, output)
+	return
+}
+
+// GetAccountConfiguration API operation for AWS Certificate Manager.
+//
+// Returns the account configuration options associated with an AWS account.
+//
+// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
+// with awserr.Error's Code and Message methods to get detailed information about
+// the error.
+//
+// See the AWS API reference guide for AWS Certificate Manager's
+// API operation GetAccountConfiguration for usage and error information.
+//
+// Returned Error Types:
+//   * AccessDeniedException
+//   You do not have access required to perform this action.
+//
+//   * ThrottlingException
+//   The request was denied because it exceeded a quota.
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/acm-2015-12-08/GetAccountConfiguration
+func (c *ACM) GetAccountConfiguration(input *GetAccountConfigurationInput) (*GetAccountConfigurationOutput, error) {
+	req, out := c.GetAccountConfigurationRequest(input)
+	return out, req.Send()
+}
+
+// GetAccountConfigurationWithContext is the same as GetAccountConfiguration with the addition of
+// the ability to pass a context and additional request options.
+//
+// See GetAccountConfiguration for details on how to use this API operation.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *ACM) GetAccountConfigurationWithContext(ctx aws.Context, input *GetAccountConfigurationInput, opts ...request.Option) (*GetAccountConfigurationOutput, error) {
+	req, out := c.GetAccountConfigurationRequest(input)
+	req.SetContext(ctx)
+	req.ApplyOptions(opts...)
+	return out, req.Send()
+}
+
 const opGetCertificate = "GetCertificate"
 
 // GetCertificateRequest generates a "aws/request.Request" representing the
@@ -554,6 +639,8 @@ func (c *ACM) ImportCertificateRequest(input *ImportCertificateInput) (req *requ
 //    * The private key must be unencrypted. You cannot import a private key
 //    that is protected by a password or a passphrase.
 //
+//    * The private key must be no larger than 5 KB (5,120 bytes).
+//
 //    * If the certificate you are importing is not self-signed, you must enter
 //    its certificate chain.
 //
@@ -570,12 +657,12 @@ func (c *ACM) ImportCertificateRequest(input *ImportCertificateInput) (req *requ
 //    * The OCSP authority URL, if present, must not exceed 1000 characters.
 //
 //    * To import a new certificate, omit the CertificateArn argument. Include
-//    this argument only when you want to replace a previously imported certifica
+//    this argument only when you want to replace a previously imported certificate.
 //
 //    * When you import a certificate by using the CLI, you must specify the
 //    certificate, the certificate chain, and the private key by their file
-//    names preceded by file://. For example, you can specify a certificate
-//    saved in the C:\temp folder as file://C:\temp\certificate_to_import.pem.
+//    names preceded by fileb://. For example, you can specify a certificate
+//    saved in the C:\temp folder as fileb://C:\temp\certificate_to_import.pem.
 //    If you are making an HTTP or HTTPS Query request, include these arguments
 //    as BLOBs.
 //
@@ -618,6 +705,9 @@ func (c *ACM) ImportCertificateRequest(input *ImportCertificateInput) (req *requ
 //   * InvalidParameterException
 //   An input parameter was invalid.
 //
+//   * InvalidArnException
+//   The requested Amazon Resource Name (ARN) does not refer to an existing resource.
+//
 // See also, https://docs.aws.amazon.com/goto/WebAPI/acm-2015-12-08/ImportCertificate
 func (c *ACM) ImportCertificate(input *ImportCertificateInput) (*ImportCertificateOutput, error) {
 	req, out := c.ImportCertificateRequest(input)
@@ -866,6 +956,102 @@ func (c *ACM) ListTagsForCertificateWithContext(ctx aws.Context, input *ListTags
 	return out, req.Send()
 }
 
+const opPutAccountConfiguration = "PutAccountConfiguration"
+
+// PutAccountConfigurationRequest generates a "aws/request.Request" representing the
+// client's request for the PutAccountConfiguration operation. The "output" return
+// value will be populated with the request's response once the request completes
+// successfully.
+//
+// Use "Send" method on the returned Request to send the API call to the service.
+// the "output" return value is not valid until after Send returns without error.
+//
+// See PutAccountConfiguration for more information on using the PutAccountConfiguration
+// API call, and error handling.
+//
+// This method is useful when you want to inject custom logic or configuration
+// into the SDK's request lifecycle. Such as custom headers, or retry logic.
+//
+//
+//    // Example sending a request using the PutAccountConfigurationRequest method.
+//    req, resp := client.PutAccountConfigurationRequest(params)
+//
+//    err := req.Send()
+//    if err == nil { // resp is now filled
+//        fmt.Println(resp)
+//    }
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/acm-2015-12-08/PutAccountConfiguration
+func (c *ACM) PutAccountConfigurationRequest(input *PutAccountConfigurationInput) (req *request.Request, output *PutAccountConfigurationOutput) {
+	op := &request.Operation{
+		Name:       opPutAccountConfiguration,
+		HTTPMethod: "POST",
+		HTTPPath:   "/",
+	}
+
+	if input == nil {
+		input = &PutAccountConfigurationInput{}
+	}
+
+	output = &PutAccountConfigurationOutput{}
+	req = c.newRequest(op, input, output)
+	req.Handlers.Unmarshal.Swap(jsonrpc.UnmarshalHandler.Name, protocol.UnmarshalDiscardBodyHandler)
+	return
+}
+
+// PutAccountConfiguration API operation for AWS Certificate Manager.
+//
+// Adds or modifies account-level configurations in ACM.
+//
+// The supported configuration option is DaysBeforeExpiry. This option specifies
+// the number of days prior to certificate expiration when ACM starts generating
+// EventBridge events. ACM sends one event per day per certificate until the
+// certificate expires. By default, accounts receive events starting 45 days
+// before certificate expiration.
+//
+// Returns awserr.Error for service API and SDK errors. Use runtime type assertions
+// with awserr.Error's Code and Message methods to get detailed information about
+// the error.
+//
+// See the AWS API reference guide for AWS Certificate Manager's
+// API operation PutAccountConfiguration for usage and error information.
+//
+// Returned Error Types:
+//   * ValidationException
+//   The supplied input failed to satisfy constraints of an AWS service.
+//
+//   * ThrottlingException
+//   The request was denied because it exceeded a quota.
+//
+//   * AccessDeniedException
+//   You do not have access required to perform this action.
+//
+//   * ConflictException
+//   You are trying to update a resource or configuration that is already being
+//   created or updated. Wait for the previous operation to finish and try again.
+//
+// See also, https://docs.aws.amazon.com/goto/WebAPI/acm-2015-12-08/PutAccountConfiguration
+func (c *ACM) PutAccountConfiguration(input *PutAccountConfigurationInput) (*PutAccountConfigurationOutput, error) {
+	req, out := c.PutAccountConfigurationRequest(input)
+	return out, req.Send()
+}
+
+// PutAccountConfigurationWithContext is the same as PutAccountConfiguration with the addition of
+// the ability to pass a context and additional request options.
+//
+// See PutAccountConfiguration for details on how to use this API operation.
+//
+// The context must be non-nil and will be used for request cancellation. If
+// the context is nil a panic will occur. In the future the SDK may create
+// sub-contexts for http.Requests. See https://golang.org/pkg/context/
+// for more information on using Contexts.
+func (c *ACM) PutAccountConfigurationWithContext(ctx aws.Context, input *PutAccountConfigurationInput, opts ...request.Option) (*PutAccountConfigurationOutput, error) {
+	req, out := c.PutAccountConfigurationRequest(input)
+	req.SetContext(ctx)
+	req.ApplyOptions(opts...)
+	return out, req.Send()
+}
+
 const opRemoveTagsFromCertificate = "RemoveTagsFromCertificate"
 
 // RemoveTagsFromCertificateRequest generates a "aws/request.Request" representing the
@@ -945,6 +1131,9 @@ func (c *ACM) RemoveTagsFromCertificateRequest(input *RemoveTagsFromCertificateI
 //   * InvalidParameterException
 //   An input parameter was invalid.
 //
+//   * ThrottlingException
+//   The request was denied because it exceeded a quota.
+//
 // See also, https://docs.aws.amazon.com/goto/WebAPI/acm-2015-12-08/RemoveTagsFromCertificate
 func (c *ACM) RemoveTagsFromCertificate(input *RemoveTagsFromCertificateInput) (*RemoveTagsFromCertificateOutput, error) {
 	req, out := c.RemoveTagsFromCertificateRequest(input)
@@ -1012,7 +1201,7 @@ func (c *ACM) RenewCertificateRequest(input *RenewCertificateInput) (req *reques
 
 // RenewCertificate API operation for AWS Certificate Manager.
 //
-// Renews an eligable ACM certificate. At this time, only exported private certificates
+// Renews an eligible ACM certificate. At this time, only exported private certificates
 // can be renewed with this operation. In order to renew your ACM PCA certificates
 // with ACM, you must first grant the ACM service principal permission to do
 // so (https://docs.aws.amazon.com/acm-pca/latest/userguide/PcaPermissions.html).
@@ -1358,6 +1547,62 @@ func (c *ACM) UpdateCertificateOptionsWithContext(ctx aws.Context, input *Update
 	return out, req.Send()
 }
 
+// You do not have access required to perform this action.
+type AccessDeniedException struct {
+	_            struct{}                  `type:"structure"`
+	RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"`
+
+	Message_ *string `locationName:"Message" type:"string"`
+}
+
+// String returns the string representation
+func (s AccessDeniedException) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s AccessDeniedException) GoString() string {
+	return s.String()
+}
+
+func newErrorAccessDeniedException(v protocol.ResponseMetadata) error {
+	return &AccessDeniedException{
+		RespMetadata: v,
+	}
+}
+
+// Code returns the exception type name.
+func (s *AccessDeniedException) Code() string {
+	return "AccessDeniedException"
+}
+
+// Message returns the exception's message.
+func (s *AccessDeniedException) Message() string {
+	if s.Message_ != nil {
+		return *s.Message_
+	}
+	return ""
+}
+
+// OrigErr always returns nil, satisfies awserr.Error interface.
+func (s *AccessDeniedException) OrigErr() error {
+	return nil
+}
+
+func (s *AccessDeniedException) Error() string {
+	return fmt.Sprintf("%s: %s", s.Code(), s.Message())
+}
+
+// Status code returns the HTTP status code for the request's response error.
+func (s *AccessDeniedException) StatusCode() int {
+	return s.RespMetadata.StatusCode
+}
+
+// RequestID returns the service's response RequestID for request.
+func (s *AccessDeniedException) RequestID() string {
+	return s.RespMetadata.RequestID
+}
+
 type AddTagsToCertificateInput struct {
 	_ struct{} `type:"structure"`
 
@@ -1366,8 +1611,7 @@ type AddTagsToCertificateInput struct {
 	//
 	// arn:aws:acm:region:123456789012:certificate/12345678-1234-1234-1234-123456789012
 	//
-	// For more information about ARNs, see Amazon Resource Names (ARNs) and AWS
-	// Service Namespaces (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html).
+	// For more information about ARNs, see Amazon Resource Names (ARNs) (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html).
 	//
 	// CertificateArn is a required field
 	CertificateArn *string `min:"20" type:"string" required:"true"`
@@ -1452,7 +1696,7 @@ type CertificateDetail struct {
 	_ struct{} `type:"structure"`
 
 	// The Amazon Resource Name (ARN) of the certificate. For more information about
-	// ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html)
+	// ARNs, see Amazon Resource Names (ARNs) (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html)
 	// in the AWS General Reference.
 	CertificateArn *string `min:"20" type:"string"`
 
@@ -1462,8 +1706,7 @@ type CertificateDetail struct {
 	// arn:aws:acm-pca:region:account:certificate-authority/12345678-1234-1234-1234-123456789012
 	CertificateAuthorityArn *string `min:"20" type:"string"`
 
-	// The time at which the certificate was requested. This value exists only when
-	// the certificate type is AMAZON_ISSUED.
+	// The time at which the certificate was requested.
 	CreatedAt *time.Time `type:"timestamp"`
 
 	// The fully qualified domain name for the certificate, such as www.example.com
@@ -1776,8 +2019,7 @@ type CertificateSummary struct {
 	//
 	// arn:aws:acm:region:123456789012:certificate/12345678-1234-1234-1234-123456789012
 	//
-	// For more information about ARNs, see Amazon Resource Names (ARNs) and AWS
-	// Service Namespaces (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html).
+	// For more information about ARNs, see Amazon Resource Names (ARNs) (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html).
 	CertificateArn *string `min:"20" type:"string"`
 
 	// Fully qualified domain name (FQDN), such as www.example.com or example.com,
@@ -1807,6 +2049,63 @@ func (s *CertificateSummary) SetDomainName(v string) *CertificateSummary {
 	return s
 }
 
+// You are trying to update a resource or configuration that is already being
+// created or updated. Wait for the previous operation to finish and try again.
+type ConflictException struct {
+	_            struct{}                  `type:"structure"`
+	RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"`
+
+	Message_ *string `locationName:"message" type:"string"`
+}
+
+// String returns the string representation
+func (s ConflictException) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s ConflictException) GoString() string {
+	return s.String()
+}
+
+func newErrorConflictException(v protocol.ResponseMetadata) error {
+	return &ConflictException{
+		RespMetadata: v,
+	}
+}
+
+// Code returns the exception type name.
+func (s *ConflictException) Code() string {
+	return "ConflictException"
+}
+
+// Message returns the exception's message.
+func (s *ConflictException) Message() string {
+	if s.Message_ != nil {
+		return *s.Message_
+	}
+	return ""
+}
+
+// OrigErr always returns nil, satisfies awserr.Error interface.
+func (s *ConflictException) OrigErr() error {
+	return nil
+}
+
+func (s *ConflictException) Error() string {
+	return fmt.Sprintf("%s: %s", s.Code(), s.Message())
+}
+
+// Status code returns the HTTP status code for the request's response error.
+func (s *ConflictException) StatusCode() int {
+	return s.RespMetadata.StatusCode
+}
+
+// RequestID returns the service's response RequestID for request.
+func (s *ConflictException) RequestID() string {
+	return s.RespMetadata.RequestID
+}
+
 type DeleteCertificateInput struct {
 	_ struct{} `type:"structure"`
 
@@ -1815,8 +2114,7 @@ type DeleteCertificateInput struct {
 	//
 	// arn:aws:acm:region:123456789012:certificate/12345678-1234-1234-1234-123456789012
 	//
-	// For more information about ARNs, see Amazon Resource Names (ARNs) and AWS
-	// Service Namespaces (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html).
+	// For more information about ARNs, see Amazon Resource Names (ARNs) (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html).
 	//
 	// CertificateArn is a required field
 	CertificateArn *string `min:"20" type:"string" required:"true"`
@@ -1876,8 +2174,7 @@ type DescribeCertificateInput struct {
 	//
 	// arn:aws:acm:region:123456789012:certificate/12345678-1234-1234-1234-123456789012
 	//
-	// For more information about ARNs, see Amazon Resource Names (ARNs) and AWS
-	// Service Namespaces (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html).
+	// For more information about ARNs, see Amazon Resource Names (ARNs) (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html).
 	//
 	// CertificateArn is a required field
 	CertificateArn *string `min:"20" type:"string" required:"true"`
@@ -2098,6 +2395,46 @@ func (s *DomainValidationOption) SetValidationDomain(v string) *DomainValidation
 	return s
 }
 
+// Object containing expiration events options associated with an AWS account.
+type ExpiryEventsConfiguration struct {
+	_ struct{} `type:"structure"`
+
+	// Specifies the number of days prior to certificate expiration when ACM starts
+	// generating EventBridge events. ACM sends one event per day per certificate
+	// until the certificate expires. By default, accounts receive events starting
+	// 45 days before certificate expiration.
+	DaysBeforeExpiry *int64 `min:"1" type:"integer"`
+}
+
+// String returns the string representation
+func (s ExpiryEventsConfiguration) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s ExpiryEventsConfiguration) GoString() string {
+	return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *ExpiryEventsConfiguration) Validate() error {
+	invalidParams := request.ErrInvalidParams{Context: "ExpiryEventsConfiguration"}
+	if s.DaysBeforeExpiry != nil && *s.DaysBeforeExpiry < 1 {
+		invalidParams.Add(request.NewErrParamMinValue("DaysBeforeExpiry", 1))
+	}
+
+	if invalidParams.Len() > 0 {
+		return invalidParams
+	}
+	return nil
+}
+
+// SetDaysBeforeExpiry sets the DaysBeforeExpiry field's value.
+func (s *ExpiryEventsConfiguration) SetDaysBeforeExpiry(v int64) *ExpiryEventsConfiguration {
+	s.DaysBeforeExpiry = &v
+	return s
+}
+
 type ExportCertificateInput struct {
 	_ struct{} `type:"structure"`
 
@@ -2273,10 +2610,10 @@ type Filters struct {
 
 	// Specify one or more algorithms that can be used to generate key pairs.
 	//
-	// Default filtering returns only RSA_2048 certificates. To return other certificate
-	// types, provide the desired type signatures in a comma-separated list. For
-	// example, "keyTypes": ["RSA_2048,RSA_4096"] returns both RSA_2048 and RSA_4096
-	// certificates.
+	// Default filtering returns only RSA_1024 and RSA_2048 certificates that have
+	// at least one domain. To return other certificate types, provide the desired
+	// type signatures in a comma-separated list. For example, "keyTypes": ["RSA_2048,RSA_4096"]
+	// returns both RSA_2048 and RSA_4096 certificates.
 	KeyTypes []*string `locationName:"keyTypes" type:"list"`
 
 	// Specify one or more KeyUsage extension values.
@@ -2311,6 +2648,43 @@ func (s *Filters) SetKeyUsage(v []*string) *Filters {
 	return s
 }
 
+type GetAccountConfigurationInput struct {
+	_ struct{} `type:"structure"`
+}
+
+// String returns the string representation
+func (s GetAccountConfigurationInput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s GetAccountConfigurationInput) GoString() string {
+	return s.String()
+}
+
+type GetAccountConfigurationOutput struct {
+	_ struct{} `type:"structure"`
+
+	// Expiration events configuration options associated with the AWS account.
+	ExpiryEvents *ExpiryEventsConfiguration `type:"structure"`
+}
+
+// String returns the string representation
+func (s GetAccountConfigurationOutput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s GetAccountConfigurationOutput) GoString() string {
+	return s.String()
+}
+
+// SetExpiryEvents sets the ExpiryEvents field's value.
+func (s *GetAccountConfigurationOutput) SetExpiryEvents(v *ExpiryEventsConfiguration) *GetAccountConfigurationOutput {
+	s.ExpiryEvents = v
+	return s
+}
+
 type GetCertificateInput struct {
 	_ struct{} `type:"structure"`
 
@@ -2318,8 +2692,7 @@ type GetCertificateInput struct {
 	//
 	// arn:aws:acm:region:123456789012:certificate/12345678-1234-1234-1234-123456789012
 	//
-	// For more information about ARNs, see Amazon Resource Names (ARNs) and AWS
-	// Service Namespaces (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html).
+	// For more information about ARNs, see Amazon Resource Names (ARNs) (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html).
 	//
 	// CertificateArn is a required field
 	CertificateArn *string `min:"20" type:"string" required:"true"`
@@ -3059,8 +3432,7 @@ type ListTagsForCertificateInput struct {
 	//
 	// arn:aws:acm:region:123456789012:certificate/12345678-1234-1234-1234-123456789012
 	//
-	// For more information about ARNs, see Amazon Resource Names (ARNs) and AWS
-	// Service Namespaces (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html).
+	// For more information about ARNs, see Amazon Resource Names (ARNs) (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html).
 	//
 	// CertificateArn is a required field
 	CertificateArn *string `min:"20" type:"string" required:"true"`
@@ -3121,6 +3493,79 @@ func (s *ListTagsForCertificateOutput) SetTags(v []*Tag) *ListTagsForCertificate
 	return s
 }
 
+type PutAccountConfigurationInput struct {
+	_ struct{} `type:"structure"`
+
+	// Specifies expiration events associated with an account.
+	ExpiryEvents *ExpiryEventsConfiguration `type:"structure"`
+
+	// Customer-chosen string used to distinguish between calls to PutAccountConfiguration.
+	// Idempotency tokens time out after one hour. If you call PutAccountConfiguration
+	// multiple times with the same unexpired idempotency token, ACM treats it as
+	// the same request and returns the original result. If you change the idempotency
+	// token for each call, ACM treats each call as a new request.
+	//
+	// IdempotencyToken is a required field
+	IdempotencyToken *string `min:"1" type:"string" required:"true"`
+}
+
+// String returns the string representation
+func (s PutAccountConfigurationInput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s PutAccountConfigurationInput) GoString() string {
+	return s.String()
+}
+
+// Validate inspects the fields of the type to determine if they are valid.
+func (s *PutAccountConfigurationInput) Validate() error {
+	invalidParams := request.ErrInvalidParams{Context: "PutAccountConfigurationInput"}
+	if s.IdempotencyToken == nil {
+		invalidParams.Add(request.NewErrParamRequired("IdempotencyToken"))
+	}
+	if s.IdempotencyToken != nil && len(*s.IdempotencyToken) < 1 {
+		invalidParams.Add(request.NewErrParamMinLen("IdempotencyToken", 1))
+	}
+	if s.ExpiryEvents != nil {
+		if err := s.ExpiryEvents.Validate(); err != nil {
+			invalidParams.AddNested("ExpiryEvents", err.(request.ErrInvalidParams))
+		}
+	}
+
+	if invalidParams.Len() > 0 {
+		return invalidParams
+	}
+	return nil
+}
+
+// SetExpiryEvents sets the ExpiryEvents field's value.
+func (s *PutAccountConfigurationInput) SetExpiryEvents(v *ExpiryEventsConfiguration) *PutAccountConfigurationInput {
+	s.ExpiryEvents = v
+	return s
+}
+
+// SetIdempotencyToken sets the IdempotencyToken field's value.
+func (s *PutAccountConfigurationInput) SetIdempotencyToken(v string) *PutAccountConfigurationInput {
+	s.IdempotencyToken = &v
+	return s
+}
+
+type PutAccountConfigurationOutput struct {
+	_ struct{} `type:"structure"`
+}
+
+// String returns the string representation
+func (s PutAccountConfigurationOutput) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s PutAccountConfigurationOutput) GoString() string {
+	return s.String()
+}
+
 type RemoveTagsFromCertificateInput struct {
 	_ struct{} `type:"structure"`
 
@@ -3129,8 +3574,7 @@ type RemoveTagsFromCertificateInput struct {
 	//
 	// arn:aws:acm:region:123456789012:certificate/12345678-1234-1234-1234-123456789012
 	//
-	// For more information about ARNs, see Amazon Resource Names (ARNs) and AWS
-	// Service Namespaces (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html).
+	// For more information about ARNs, see Amazon Resource Names (ARNs) (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html).
 	//
 	// CertificateArn is a required field
 	CertificateArn *string `min:"20" type:"string" required:"true"`
@@ -3217,8 +3661,7 @@ type RenewCertificateInput struct {
 	//
 	// arn:aws:acm:region:123456789012:certificate/12345678-1234-1234-1234-123456789012
 	//
-	// For more information about ARNs, see Amazon Resource Names (ARNs) and AWS
-	// Service Namespaces (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html).
+	// For more information about ARNs, see Amazon Resource Names (ARNs) (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html).
 	//
 	// CertificateArn is a required field
 	CertificateArn *string `min:"20" type:"string" required:"true"`
@@ -3988,6 +4431,62 @@ func (s *TagPolicyException) RequestID() string {
 	return s.RespMetadata.RequestID
 }
 
+// The request was denied because it exceeded a quota.
+type ThrottlingException struct {
+	_            struct{}                  `type:"structure"`
+	RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"`
+
+	Message_ *string `locationName:"message" type:"string"`
+}
+
+// String returns the string representation
+func (s ThrottlingException) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s ThrottlingException) GoString() string {
+	return s.String()
+}
+
+func newErrorThrottlingException(v protocol.ResponseMetadata) error {
+	return &ThrottlingException{
+		RespMetadata: v,
+	}
+}
+
+// Code returns the exception type name.
+func (s *ThrottlingException) Code() string {
+	return "ThrottlingException"
+}
+
+// Message returns the exception's message.
+func (s *ThrottlingException) Message() string {
+	if s.Message_ != nil {
+		return *s.Message_
+	}
+	return ""
+}
+
+// OrigErr always returns nil, satisfies awserr.Error interface.
+func (s *ThrottlingException) OrigErr() error {
+	return nil
+}
+
+func (s *ThrottlingException) Error() string {
+	return fmt.Sprintf("%s: %s", s.Code(), s.Message())
+}
+
+// Status code returns the HTTP status code for the request's response error.
+func (s *ThrottlingException) StatusCode() int {
+	return s.RespMetadata.StatusCode
+}
+
+// RequestID returns the service's response RequestID for request.
+func (s *ThrottlingException) RequestID() string {
+	return s.RespMetadata.RequestID
+}
+
 // The request contains too many tags. Try the request again with fewer tags.
 type TooManyTagsException struct {
 	_            struct{}                  `type:"structure"`
@@ -4119,6 +4618,62 @@ func (s UpdateCertificateOptionsOutput) GoString() string {
 	return s.String()
 }
 
+// The supplied input failed to satisfy constraints of an AWS service.
+type ValidationException struct {
+	_            struct{}                  `type:"structure"`
+	RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"`
+
+	Message_ *string `locationName:"message" type:"string"`
+}
+
+// String returns the string representation
+func (s ValidationException) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s ValidationException) GoString() string {
+	return s.String()
+}
+
+func newErrorValidationException(v protocol.ResponseMetadata) error {
+	return &ValidationException{
+		RespMetadata: v,
+	}
+}
+
+// Code returns the exception type name.
+func (s *ValidationException) Code() string {
+	return "ValidationException"
+}
+
+// Message returns the exception's message.
+func (s *ValidationException) Message() string {
+	if s.Message_ != nil {
+		return *s.Message_
+	}
+	return ""
+}
+
+// OrigErr always returns nil, satisfies awserr.Error interface.
+func (s *ValidationException) OrigErr() error {
+	return nil
+}
+
+func (s *ValidationException) Error() string {
+	return fmt.Sprintf("%s: %s", s.Code(), s.Message())
+}
+
+// Status code returns the HTTP status code for the request's response error.
+func (s *ValidationException) StatusCode() int {
+	return s.RespMetadata.StatusCode
+}
+
+// RequestID returns the service's response RequestID for request.
+func (s *ValidationException) RequestID() string {
+	return s.RespMetadata.RequestID
+}
+
 const (
 	// CertificateStatusPendingValidation is a CertificateStatus enum value
 	CertificateStatusPendingValidation = "PENDING_VALIDATION"

vendor/github.com/aws/aws-sdk-go/service/acm/doc.go

@@ -3,11 +3,9 @@
 // Package acm provides the client and types for making API
 // requests to AWS Certificate Manager.
 //
-// Welcome to the AWS Certificate Manager (ACM) API documentation.
-//
-// You can use ACM to manage SSL/TLS certificates for your AWS-based websites
-// and applications. For general information about using ACM, see the AWS Certificate
-// Manager User Guide (https://docs.aws.amazon.com/acm/latest/userguide/).
+// You can use AWS Certificate Manager (ACM) to manage SSL/TLS certificates
+// for your AWS-based websites and applications. For more information about
+// using ACM, see the AWS Certificate Manager User Guide (https://docs.aws.amazon.com/acm/latest/userguide/).
 //
 // See https://docs.aws.amazon.com/goto/WebAPI/acm-2015-12-08 for more information on this service.
 //

vendor/github.com/aws/aws-sdk-go/service/acm/errors.go

@@ -8,6 +8,19 @@ import (
 
 const (
 
+	// ErrCodeAccessDeniedException for service response error code
+	// "AccessDeniedException".
+	//
+	// You do not have access required to perform this action.
+	ErrCodeAccessDeniedException = "AccessDeniedException"
+
+	// ErrCodeConflictException for service response error code
+	// "ConflictException".
+	//
+	// You are trying to update a resource or configuration that is already being
+	// created or updated. Wait for the previous operation to finish and try again.
+	ErrCodeConflictException = "ConflictException"
+
 	// ErrCodeInvalidArgsException for service response error code
 	// "InvalidArgsException".
 	//
@@ -78,14 +91,28 @@ const (
 	// A specified tag did not comply with an existing tag policy and was rejected.
 	ErrCodeTagPolicyException = "TagPolicyException"
 
+	// ErrCodeThrottlingException for service response error code
+	// "ThrottlingException".
+	//
+	// The request was denied because it exceeded a quota.
+	ErrCodeThrottlingException = "ThrottlingException"
+
 	// ErrCodeTooManyTagsException for service response error code
 	// "TooManyTagsException".
 	//
 	// The request contains too many tags. Try the request again with fewer tags.
 	ErrCodeTooManyTagsException = "TooManyTagsException"
+
+	// ErrCodeValidationException for service response error code
+	// "ValidationException".
+	//
+	// The supplied input failed to satisfy constraints of an AWS service.
+	ErrCodeValidationException = "ValidationException"
 )
 
 var exceptionFromCode = map[string]func(protocol.ResponseMetadata) error{
+	"AccessDeniedException":                   newErrorAccessDeniedException,
+	"ConflictException":                       newErrorConflictException,
 	"InvalidArgsException":                    newErrorInvalidArgsException,
 	"InvalidArnException":                     newErrorInvalidArnException,
 	"InvalidDomainValidationOptionsException": newErrorInvalidDomainValidationOptionsException,
@@ -97,5 +124,7 @@ var exceptionFromCode = map[string]func(protocol.ResponseMetadata) error{
 	"ResourceInUseException":                  newErrorResourceInUseException,
 	"ResourceNotFoundException":               newErrorResourceNotFoundException,
 	"TagPolicyException":                      newErrorTagPolicyException,
+	"ThrottlingException":                     newErrorThrottlingException,
 	"TooManyTagsException":                    newErrorTooManyTagsException,
+	"ValidationException":                     newErrorValidationException,
 }

vendor/github.com/aws/aws-sdk-go/service/cloudtrail/api.go

@@ -255,9 +255,10 @@ func (c *CloudTrail) CreateTrailRequest(input *CreateTrailInput) (req *request.R
 //   valid.
 //
 //   * KmsKeyNotFoundException
-//   This exception is thrown when the KMS key does not exist, when the S3 bucket
-//   and the KMS key are not in the same region, or when the KMS key associated
-//   with the SNS topic either does not exist or is not in the same region.
+//   This exception is thrown when the AWS KMS key does not exist, when the S3
+//   bucket and the AWS KMS key are not in the same region, or when the AWS KMS
+//   key associated with the SNS topic either does not exist or is not in the
+//   same region.
 //
 //   * KmsKeyDisabledException
 //   This exception is no longer in use.
@@ -439,6 +440,12 @@ func (c *CloudTrail) DeleteTrailRequest(input *DeleteTrailInput) (req *request.R
 //   an organization trail in a required service. For more information, see Prepare
 //   For Creating a Trail For Your Organization (https://docs.aws.amazon.com/awscloudtrail/latest/userguide/creating-an-organizational-trail-prepare.html).
 //
+//   * ConflictException
+//   This exception is thrown when the specified resource is not ready for an
+//   operation. This can occur when you try to run an operation on a trail before
+//   CloudTrail has time to fully load the trail. If this exception occurs, wait
+//   a few minutes, and then try the operation again.
+//
 // See also, https://docs.aws.amazon.com/goto/WebAPI/cloudtrail-2013-11-01/DeleteTrail
 func (c *CloudTrail) DeleteTrail(input *DeleteTrailInput) (*DeleteTrailOutput, error) {
 	req, out := c.DeleteTrailRequest(input)
@@ -612,8 +619,8 @@ func (c *CloudTrail) GetEventSelectorsRequest(input *GetEventSelectorsInput) (re
 //
 //    * If your event selector includes management events.
 //
-//    * If your event selector includes data events, the Amazon S3 objects or
-//    AWS Lambda functions that you are logging for data events.
+//    * If your event selector includes data events, the resources on which
+//    you are logging data events.
 //
 // For more information, see Logging Data and Management Events for Trails (https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-management-and-data-events-with-cloudtrail.html)
 // in the AWS CloudTrail User Guide.
@@ -1926,6 +1933,13 @@ func (c *CloudTrail) PutInsightSelectorsRequest(input *PutInsightSelectorsInput)
 //   This exception is thrown when the policy on the S3 bucket or KMS key is not
 //   sufficient.
 //
+//   * S3BucketDoesNotExistException
+//   This exception is thrown when the specified S3 bucket does not exist.
+//
+//   * KmsException
+//   This exception is thrown when there is an issue with the specified KMS key
+//   and the trail can’t be updated.
+//
 //   * UnsupportedOperationException
 //   This exception is thrown when the requested operation is not supported.
 //
@@ -2469,9 +2483,10 @@ func (c *CloudTrail) UpdateTrailRequest(input *UpdateTrailInput) (req *request.R
 //   other than the region in which the trail was created.
 //
 //   * KmsKeyNotFoundException
-//   This exception is thrown when the KMS key does not exist, when the S3 bucket
-//   and the KMS key are not in the same region, or when the KMS key associated
-//   with the SNS topic either does not exist or is not in the same region.
+//   This exception is thrown when the AWS KMS key does not exist, when the S3
+//   bucket and the AWS KMS key are not in the same region, or when the AWS KMS
+//   key associated with the SNS topic either does not exist or is not in the
+//   same region.
 //
 //   * KmsKeyDisabledException
 //   This exception is no longer in use.
@@ -2857,19 +2872,31 @@ type AdvancedFieldSelector struct {
 	//    value must be Management or Data.
 	//
 	//    * resources.type - This field is required. resources.type can only use
-	//    the Equals operator, and the value can be one of the following: AWS::S3::Object
-	//    or AWS::Lambda::Function. You can have only one resources.type field
-	//    per selector. To log data events on more than one resource type, add another
-	//    selector.
+	//    the Equals operator, and the value can be one of the following: AWS::S3::Object,
+	//    AWS::Lambda::Function, AWS::DynamoDB::Table, AWS::S3Outposts::Object,
+	//    AWS::ManagedBlockchain::Node, or AWS::S3ObjectLambda::AccessPoint. You
+	//    can have only one resources.type field per selector. To log data events
+	//    on more than one resource type, add another selector.
 	//
 	//    * resources.ARN - You can use any operator with resources.ARN, but if
 	//    you use Equals or NotEquals, the value must exactly match the ARN of a
 	//    valid resource of the type you've specified in the template as the value
 	//    of resources.type. For example, if resources.type equals AWS::S3::Object,
-	//    the ARN must be in one of the following formats. The trailing slash is
-	//    intentional; do not exclude it. arn:partition:s3:::bucket_name/ arn:partition:s3:::bucket_name/object_or_file_name/
+	//    the ARN must be in one of the following formats. To log all data events
+	//    for all objects in a specific S3 bucket, use the StartsWith operator,
+	//    and include only the bucket ARN as the matching value. The trailing slash
+	//    is intentional; do not exclude it. arn:partition:s3:::bucket_name/ arn:partition:s3:::bucket_name/object_or_file_name/
 	//    When resources.type equals AWS::Lambda::Function, and the operator is
 	//    set to Equals or NotEquals, the ARN must be in the following format: arn:partition:lambda:region:account_ID:function:function_name
+	//    When resources.type equals AWS::DynamoDB::Table, and the operator is set
+	//    to Equals or NotEquals, the ARN must be in the following format: arn:partition:dynamodb:region:account_ID:table:table_name
+	//    When resources.type equals AWS::S3Outposts::Object, and the operator is
+	//    set to Equals or NotEquals, the ARN must be in the following format: arn:partition:s3-outposts:region:>account_ID:object_path
+	//    When resources.type equals AWS::ManagedBlockchain::Node, and the operator
+	//    is set to Equals or NotEquals, the ARN must be in the following format:
+	//    arn:partition:managedblockchain:region:account_ID:nodes/node_ID When resources.type
+	//    equals AWS::S3ObjectLambda::AccessPoint, and the operator is set to Equals
+	//    or NotEquals, the ARN must be in the following format: arn:partition:s3-object-lambda:region:account_ID:accesspoint/access_point_name
 	//
 	// Field is a required field
 	Field *string `min:"1" type:"string" required:"true"`
@@ -3091,6 +3118,65 @@ func (s *CloudWatchLogsDeliveryUnavailableException) RequestID() string {
 	return s.RespMetadata.RequestID
 }
 
+// This exception is thrown when the specified resource is not ready for an
+// operation. This can occur when you try to run an operation on a trail before
+// CloudTrail has time to fully load the trail. If this exception occurs, wait
+// a few minutes, and then try the operation again.
+type ConflictException struct {
+	_            struct{}                  `type:"structure"`
+	RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"`
+
+	Message_ *string `locationName:"message" type:"string"`
+}
+
+// String returns the string representation
+func (s ConflictException) String() string {
+	return awsutil.Prettify(s)
+}
+
+// GoString returns the string representation
+func (s ConflictException) GoString() string {
+	return s.String()
+}
+
+func newErrorConflictException(v protocol.ResponseMetadata) error {
+	return &ConflictException{
+		RespMetadata: v,
+	}
+}
+
+// Code returns the exception type name.
+func (s *ConflictException) Code() string {
+	return "ConflictException"
+}
+
+// Message returns the exception's message.
+func (s *ConflictException) Message() string {
+	if s.Message_ != nil {
+		return *s.Message_
+	}
+	return ""
+}
+
+// OrigErr always returns nil, satisfies awserr.Error interface.
+func (s *ConflictException) OrigErr() error {
+	return nil
+}
+
+func (s *ConflictException) Error() string {
+	return fmt.Sprintf("%s: %s", s.Code(), s.Message())
+}
+
+// Status code returns the HTTP status code for the request's response error.
+func (s *ConflictException) StatusCode() int {
+	return s.RespMetadata.StatusCode
+}
+
+// RequestID returns the service's response RequestID for request.
+func (s *ConflictException) RequestID() string {
+	return s.RespMetadata.RequestID
+}
+
 // Specifies the settings for each trail.
 type CreateTrailInput struct {
 	_ struct{} `type:"structure"`
@@ -3443,11 +3529,11 @@ func (s *CreateTrailOutput) SetTrailARN(v string) *CreateTrailOutput {
 	return s
 }
 
-// The Amazon S3 buckets or AWS Lambda functions that you specify in your event
-// selectors for your trail to log data events. Data events provide information
-// about the resource operations performed on or within a resource itself. These
-// are also known as data plane operations. You can specify up to 250 data resources
-// for a trail.
+// The Amazon S3 buckets, AWS Lambda functions, or Amazon DynamoDB tables that
+// you specify in your event selectors for your trail to log data events. Data
+// events provide information about the resource operations performed on or
+// within a resource itself. These are also known as data plane operations.
+// You can specify up to 250 data resources for a trail.
 //
 // The total number of allowed data resources is 250. This number can be distributed
 // between 1 and 5 event selectors, but the total cannot exceed 250 across all
@@ -3494,8 +3580,12 @@ func (s *CreateTrailOutput) SetTrailARN(v string) *CreateTrailOutput {
 type DataResource struct {
 	_ struct{} `type:"structure"`
 
-	// The resource type in which you want to log data events. You can specify AWS::S3::Object
-	// or AWS::Lambda::Function resources.
+	// The resource type in which you want to log data events. You can specify AWS::S3::Object,
+	// AWS::Lambda::Function, or AWS::DynamoDB::Table resources.
+	//
+	// The AWS::S3Outposts::Object, AWS::ManagedBlockchain::Node, and AWS::S3ObjectLambda::AccessPoint
+	// resource types are not valid in basic event selectors. To log data events
+	// on these resource types, use advanced event selectors.
 	Type *string `type:"string"`
 
 	// An array of Amazon Resource Name (ARN) strings or partial ARN strings for
@@ -3515,16 +3605,19 @@ type DataResource struct {
 	//    prefix such as arn:aws:s3:::bucket-1/example-images. The trail logs data
 	//    events for objects in this S3 bucket that match the prefix.
 	//
-	//    * To log data events for all functions in your AWS account, specify the
-	//    prefix as arn:aws:lambda. This will also enable logging of Invoke activity
-	//    performed by any user or role in your AWS account, even if that activity
-	//    is performed on a function that belongs to another AWS account.
+	//    * To log data events for all Lambda functions in your AWS account, specify
+	//    the prefix as arn:aws:lambda. This will also enable logging of Invoke
+	//    activity performed by any user or role in your AWS account, even if that
+	//    activity is performed on a function that belongs to another AWS account.
 	//
 	//    * To log data events for a specific Lambda function, specify the function
 	//    ARN. Lambda function ARNs are exact. For example, if you specify a function
 	//    ARN arn:aws:lambda:us-west-2:111111111111:function:helloworld, data events
 	//    will only be logged for arn:aws:lambda:us-west-2:111111111111:function:helloworld.
 	//    They will not be logged for arn:aws:lambda:us-west-2:111111111111:function:helloworld2.
+	//
+	//    * To log data events for all DynamoDB tables in your AWS account, specify
+	//    the prefix as arn:aws:dynamodb.
 	Values []*string `type:"list"`
 }
 
@@ -3806,10 +3899,10 @@ type EventSelector struct {
 	_ struct{} `type:"structure"`
 
 	// CloudTrail supports data event logging for Amazon S3 objects and AWS Lambda
-	// functions. You can specify up to 250 resources for an individual event selector,
-	// but the total number of data resources cannot exceed 250 across all event
-	// selectors in a trail. This limit does not apply if you configure resource
-	// logging for all data events.
+	// functions with basic event selectors. You can specify up to 250 resources
+	// for an individual event selector, but the total number of data resources
+	// cannot exceed 250 across all event selectors in a trail. This limit does
+	// not apply if you configure resource logging for all data events.
 	//
 	// For more information, see Data Events (https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-management-and-data-events-with-cloudtrail.html#logging-data-events)
 	// and Limits in AWS CloudTrail (https://docs.aws.amazon.com/awscloudtrail/latest/userguide/WhatIsCloudTrail-Limits.html)
@@ -5842,9 +5935,10 @@ func (s *KmsKeyDisabledException) RequestID() string {
 	return s.RespMetadata.RequestID
 }
 
-// This exception is thrown when the KMS key does not exist, when the S3 bucket
-// and the KMS key are not in the same region, or when the KMS key associated
-// with the SNS topic either does not exist or is not in the same region.
+// This exception is thrown when the AWS KMS key does not exist, when the S3
+// bucket and the AWS KMS key are not in the same region, or when the AWS KMS
+// key associated with the SNS topic either does not exist or is not in the
+// same region.
 type KmsKeyNotFoundException struct {
 	_            struct{}                  `type:"structure"`
 	RespMetadata protocol.ResponseMetadata `json:"-" xml:"-"`

vendor/github.com/aws/aws-sdk-go/service/cloudtrail/errors.go

@@ -40,6 +40,15 @@ const (
 	// Cannot set a CloudWatch Logs delivery for this region.
 	ErrCodeCloudWatchLogsDeliveryUnavailableException = "CloudWatchLogsDeliveryUnavailableException"
 
+	// ErrCodeConflictException for service response error code
+	// "ConflictException".
+	//
+	// This exception is thrown when the specified resource is not ready for an
+	// operation. This can occur when you try to run an operation on a trail before
+	// CloudTrail has time to fully load the trail. If this exception occurs, wait
+	// a few minutes, and then try the operation again.
+	ErrCodeConflictException = "ConflictException"
+
 	// ErrCodeInsightNotEnabledException for service response error code
 	// "InsightNotEnabledException".
 	//
@@ -243,9 +252,10 @@ const (
 	// ErrCodeKmsKeyNotFoundException for service response error code
 	// "KmsKeyNotFoundException".
 	//
-	// This exception is thrown when the KMS key does not exist, when the S3 bucket
-	// and the KMS key are not in the same region, or when the KMS key associated
-	// with the SNS topic either does not exist or is not in the same region.
+	// This exception is thrown when the AWS KMS key does not exist, when the S3
+	// bucket and the AWS KMS key are not in the same region, or when the AWS KMS
+	// key associated with the SNS topic either does not exist or is not in the
+	// same region.
 	ErrCodeKmsKeyNotFoundException = "KmsKeyNotFoundException"
 
 	// ErrCodeMaximumNumberOfTrailsExceededException for service response error code
@@ -342,6 +352,7 @@ var exceptionFromCode = map[string]func(protocol.ResponseMetadata) error{
 	"CloudTrailAccessNotEnabledException":                    newErrorAccessNotEnabledException,
 	"CloudTrailInvalidClientTokenIdException":                newErrorCloudTrailInvalidClientTokenIdException,
 	"CloudWatchLogsDeliveryUnavailableException":             newErrorCloudWatchLogsDeliveryUnavailableException,
+	"ConflictException":                                      newErrorConflictException,
 	"InsightNotEnabledException":                             newErrorInsightNotEnabledException,
 	"InsufficientDependencyServiceAccessPermissionException": newErrorInsufficientDependencyServiceAccessPermissionException,
 	"InsufficientEncryptionPolicyException":                  newErrorInsufficientEncryptionPolicyException,

vendor/github.com/aws/aws-sdk-go/service/ec2/doc.go

@@ -4,8 +4,14 @@
 // requests to Amazon Elastic Compute Cloud.
 //
 // Amazon Elastic Compute Cloud (Amazon EC2) provides secure and resizable computing
-// capacity in the AWS cloud. Using Amazon EC2 eliminates the need to invest
+// capacity in the AWS Cloud. Using Amazon EC2 eliminates the need to invest
 // in hardware up front, so you can develop and deploy applications faster.
+// Amazon Virtual Private Cloud (Amazon VPC) enables you to provision a logically
+// isolated section of the AWS Cloud where you can launch AWS resources in a
+// virtual network that you've defined. Amazon Elastic Block Store (Amazon EBS)
+// provides block level storage volumes for use with EC2 instances. EBS volumes
+// are highly available and reliable storage volumes that can be attached to
+// any running instance and used like a hard drive.
 //
 // To learn more, see the following resources:
 //
@@ -13,7 +19,7 @@
 //    EC2 documentation (http://aws.amazon.com/documentation/ec2)
 //
 //    * Amazon EBS: Amazon EBS product page (http://aws.amazon.com/ebs), Amazon
-//    EBS documentation (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AmazonEBS.html)
+//    EBS documentation (http://aws.amazon.com/documentation/ebs)
 //
 //    * Amazon VPC: Amazon VPC product page (http://aws.amazon.com/vpc), Amazon
 //    VPC documentation (http://aws.amazon.com/documentation/vpc)

vendor/github.com/aws/aws-sdk-go/service/ec2/waiters.go

@@ -982,7 +982,7 @@ func (c *EC2) WaitUntilSecurityGroupExistsWithContext(ctx aws.Context, input *De
 			{
 				State:    request.RetryWaiterState,
 				Matcher:  request.ErrorWaiterMatch,
-				Expected: "InvalidGroupNotFound",
+				Expected: "InvalidGroup.NotFound",
 			},
 		},
 		Logger: c.Config.Logger,

vendor/github.com/aws/aws-sdk-go/service/elasticache/errors.go

@@ -136,13 +136,13 @@ const (
 	// ErrCodeGlobalReplicationGroupAlreadyExistsFault for service response error code
 	// "GlobalReplicationGroupAlreadyExistsFault".
 	//
-	// The Global Datastore name already exists.
+	// The Global datastore name already exists.
 	ErrCodeGlobalReplicationGroupAlreadyExistsFault = "GlobalReplicationGroupAlreadyExistsFault"
 
 	// ErrCodeGlobalReplicationGroupNotFoundFault for service response error code
 	// "GlobalReplicationGroupNotFoundFault".
 	//
-	// The Global Datastore does not exist
+	// The Global datastore does not exist
 	ErrCodeGlobalReplicationGroupNotFoundFault = "GlobalReplicationGroupNotFoundFault"
 
 	// ErrCodeInsufficientCacheClusterCapacityFault for service response error code
@@ -181,7 +181,7 @@ const (
 	// ErrCodeInvalidGlobalReplicationGroupStateFault for service response error code
 	// "InvalidGlobalReplicationGroupState".
 	//
-	// The Global Datastore is not available or in primary-only state.
+	// The Global datastore is not available or in primary-only state.
 	ErrCodeInvalidGlobalReplicationGroupStateFault = "InvalidGlobalReplicationGroupState"
 
 	// ErrCodeInvalidKMSKeyFault for service response error code

vendor/github.com/aws/aws-sdk-go/service/elbv2/api.go

@@ -245,7 +245,7 @@ func (c *ELBV2) CreateListenerRequest(input *CreateListenerInput) (req *request.
 // CreateListener API operation for Elastic Load Balancing.
 //
 // Creates a listener for the specified Application Load Balancer, Network Load
-// Balancer. or Gateway Load Balancer.
+// Balancer, or Gateway Load Balancer.
 //
 // For more information, see the following:
 //
@@ -417,7 +417,8 @@ func (c *ELBV2) CreateLoadBalancerRequest(input *CreateLoadBalancerInput) (req *
 //   A load balancer with the specified name already exists.
 //
 //   * ErrCodeTooManyLoadBalancersException "TooManyLoadBalancers"
-//   You've reached the limit on the number of load balancers for your AWS account.
+//   You've reached the limit on the number of load balancers for your Amazon
+//   Web Services account.
 //
 //   * ErrCodeInvalidConfigurationRequestException "InvalidConfigurationRequest"
 //   The requested configuration is not valid.
@@ -540,7 +541,8 @@ func (c *ELBV2) CreateRuleRequest(input *CreateRuleInput) (req *request.Request,
 //   The specified priority is in use.
 //
 //   * ErrCodeTooManyTargetGroupsException "TooManyTargetGroups"
-//   You've reached the limit on the number of target groups for your AWS account.
+//   You've reached the limit on the number of target groups for your Amazon Web
+//   Services account.
 //
 //   * ErrCodeTooManyRulesException "TooManyRules"
 //   You've reached the limit on the number of rules per load balancer.
@@ -676,7 +678,8 @@ func (c *ELBV2) CreateTargetGroupRequest(input *CreateTargetGroupInput) (req *re
 //   A target group with the specified name already exists.
 //
 //   * ErrCodeTooManyTargetGroupsException "TooManyTargetGroups"
-//   You've reached the limit on the number of target groups for your AWS account.
+//   You've reached the limit on the number of target groups for your Amazon Web
+//   Services account.
 //
 //   * ErrCodeInvalidConfigurationRequestException "InvalidConfigurationRequest"
 //   The requested configuration is not valid.
@@ -1184,8 +1187,8 @@ func (c *ELBV2) DescribeAccountLimitsRequest(input *DescribeAccountLimitsInput)
 
 // DescribeAccountLimits API operation for Elastic Load Balancing.
 //
-// Describes the current Elastic Load Balancing resource limits for your AWS
-// account.
+// Describes the current Elastic Load Balancing resource limits for your Amazon
+// Web Services account.
 //
 // For more information, see the following:
 //
@@ -4672,10 +4675,10 @@ type CreateTargetGroupInput struct {
 	HealthCheckEnabled *bool `type:"boolean"`
 
 	// The approximate amount of time, in seconds, between health checks of an individual
-	// target. For TCP health checks, the supported values are 10 and 30 seconds.
-	// If the target type is instance or ip, the default is 30 seconds. If the target
-	// group protocol is GENEVE, the default is 10 seconds. If the target type is
-	// lambda, the default is 35 seconds.
+	// target. If the target group protocol is TCP, TLS, UDP, or TCP_UDP, the supported
+	// values are 10 and 30 seconds. If the target group protocol is HTTP or HTTPS,
+	// the default is 30 seconds. If the target group protocol is GENEVE, the default
+	// is 10 seconds. If the target type is lambda, the default is 35 seconds.
 	HealthCheckIntervalSeconds *int64 `min:"5" type:"integer"`
 
 	// [HTTP/HTTPS health checks] The destination for health checks on the targets.
@@ -4683,7 +4686,7 @@ type CreateTargetGroupInput struct {
 	// [HTTP1 or HTTP2 protocol version] The ping path. The default is /.
 	//
 	// [GRPC protocol version] The path of a custom health check method with the
-	// format /package.service/method. The default is /AWS.ALB/healthcheck.
+	// format /package.service/method. The default is /Amazon Web Services.ALB/healthcheck.
 	HealthCheckPath *string `min:"1" type:"string"`
 
 	// The port the load balancer uses when performing health checks on targets.
@@ -6365,7 +6368,8 @@ func (s *HttpRequestMethodConditionConfig) SetValues(v []*string) *HttpRequestMe
 	return s
 }
 
-// Information about an Elastic Load Balancing resource limit for your AWS account.
+// Information about an Elastic Load Balancing resource limit for your Amazon
+// Web Services account.
 type Limit struct {
 	_ struct{} `type:"structure"`
 
@@ -6763,7 +6767,8 @@ type LoadBalancerAttribute struct {
 	//
 	//    * waf.fail_open.enabled - Indicates whether to allow a WAF-enabled load
 	//    balancer to route requests to targets if it is unable to forward the request
-	//    to AWS WAF. The value is true or false. The default is false.
+	//    to Amazon Web Services WAF. The value is true or false. The default is
+	//    false.
 	//
 	// The following attribute is supported by Network Load Balancers and Gateway
 	// Load Balancers:
@@ -6804,7 +6809,9 @@ type LoadBalancerState struct {
 
 	// The state code. The initial state of the load balancer is provisioning. After
 	// the load balancer is fully set up and ready to route traffic, its state is
-	// active. If the load balancer could not be set up, its state is failed.
+	// active. If load balancer is routing traffic but does not have the resources
+	// it needs to scale, its state isactive_impaired. If the load balancer could
+	// not be set up, its state is failed.
 	Code *string `type:"string" enum:"LoadBalancerStateEnum"`
 
 	// A description of the state.
@@ -7284,16 +7291,19 @@ type ModifyTargetGroupInput struct {
 	// [HTTP1 or HTTP2 protocol version] The ping path. The default is /.
 	//
 	// [GRPC protocol version] The path of a custom health check method with the
-	// format /package.service/method. The default is /AWS.ALB/healthcheck.
+	// format /package.service/method. The default is /Amazon Web Services.ALB/healthcheck.
 	HealthCheckPath *string `min:"1" type:"string"`
 
 	// The port the load balancer uses when performing health checks on targets.
 	HealthCheckPort *string `type:"string"`
 
 	// The protocol the load balancer uses when performing health checks on targets.
-	// The TCP protocol is supported for health checks only if the protocol of the
-	// target group is TCP, TLS, UDP, or TCP_UDP. The GENEVE, TLS, UDP, and TCP_UDP
-	// protocols are not supported for health checks.
+	// For Application Load Balancers, the default is HTTP. For Network Load Balancers
+	// and Gateway Load Balancers, the default is TCP. The TCP protocol is not supported
+	// for health checks if the protocol of the target group is HTTP or HTTPS. It
+	// is supported for health checks only if the protocol of the target group is
+	// TCP, TLS, UDP, or TCP_UDP. The GENEVE, TLS, UDP, and TCP_UDP protocols are
+	// not supported for health checks.
 	//
 	// With Network Load Balancers, you can't modify this setting.
 	HealthCheckProtocol *string `type:"string" enum:"ProtocolEnum"`
@@ -8963,8 +8973,8 @@ type TargetGroupAttribute struct {
 	//    The value is true or false. The default is false.
 	//
 	//    * stickiness.type - The type of sticky sessions. The possible values are
-	//    lb_cookie for Application Load Balancers or source_ip for Network Load
-	//    Balancers.
+	//    lb_cookie and app_cookie for Application Load Balancers or source_ip for
+	//    Network Load Balancers.
 	//
 	// The following attributes are supported only if the load balancer is an Application
 	// Load Balancer and the target is an instance or an IP address:
@@ -8979,6 +8989,17 @@ type TargetGroupAttribute struct {
 	//    its full share of traffic. The range is 30-900 seconds (15 minutes). The
 	//    default is 0 seconds (disabled).
 	//
+	//    * stickiness.app_cookie.cookie_name - Indicates the name of the application-based
+	//    cookie. Names that start with the following prefixes are not allowed:
+	//    AWSALB, AWSALBAPP, and AWSALBTG; they're reserved for use by the load
+	//    balancer.
+	//
+	//    * stickiness.app_cookie.duration_seconds - The time period, in seconds,
+	//    during which requests from a client should be routed to the same target.
+	//    After this time period expires, the application-based cookie is considered
+	//    stale. The range is 1 second to 1 week (604800 seconds). The default value
+	//    is 1 day (86400 seconds).
+	//
 	//    * stickiness.lb_cookie.duration_seconds - The time period, in seconds,
 	//    during which requests from a client should be routed to the same target.
 	//    After this time period expires, the load balancer-generated cookie is
@@ -9001,6 +9022,12 @@ type TargetGroupAttribute struct {
 	//    the load balancer terminates connections at the end of the deregistration
 	//    timeout. The value is true or false. The default is false.
 	//
+	//    * preserve_client_ip.enabled - Indicates whether client IP preservation
+	//    is enabled. The value is true or false. The default is disabled if the
+	//    target group type is IP address and the target group protocol is TCP or
+	//    TLS. Otherwise, the default is enabled. Client IP preservation cannot
+	//    be disabled for UDP and TCP_UDP target groups.
+	//
 	//    * proxy_protocol_v2.enabled - Indicates whether Proxy Protocol version
 	//    2 is enabled. The value is true or false. The default is false.
 	Key *string `type:"string"`

vendor/github.com/aws/aws-sdk-go/service/elbv2/errors.go

@@ -183,7 +183,8 @@ const (
 	// ErrCodeTooManyLoadBalancersException for service response error code
 	// "TooManyLoadBalancers".
 	//
-	// You've reached the limit on the number of load balancers for your AWS account.
+	// You've reached the limit on the number of load balancers for your Amazon
+	// Web Services account.
 	ErrCodeTooManyLoadBalancersException = "TooManyLoadBalancers"
 
 	// ErrCodeTooManyRegistrationsForTargetIdException for service response error code
@@ -208,7 +209,8 @@ const (
 	// ErrCodeTooManyTargetGroupsException for service response error code
 	// "TooManyTargetGroups".
 	//
-	// You've reached the limit on the number of target groups for your AWS account.
+	// You've reached the limit on the number of target groups for your Amazon Web
+	// Services account.
 	ErrCodeTooManyTargetGroupsException = "TooManyTargetGroups"
 
 	// ErrCodeTooManyTargetsException for service response error code

vendor/github.com/aws/aws-sdk-go/service/iam/errors.go

@@ -17,7 +17,7 @@ const (
 	//
 	// The request was rejected because the most recent credential report has expired.
 	// To generate a new credential report, use GenerateCredentialReport. For more
-	// information about credential report expiration, see Getting Credential Reports
+	// information about credential report expiration, see Getting credential reports
 	// (https://docs.aws.amazon.com/IAM/latest/UserGuide/credential-reports.html)
 	// in the IAM User Guide.
 	ErrCodeCredentialReportExpiredException = "ReportExpired"
@@ -117,8 +117,7 @@ const (
 	// "LimitExceeded".
 	//
 	// The request was rejected because it attempted to create resources beyond
-	// the current AWS account limitations. The error message describes the limit
-	// exceeded.
+	// the current AWS account limits. The error message describes the limit exceeded.
 	ErrCodeLimitExceededException = "LimitExceeded"
 
 	// ErrCodeMalformedCertificateException for service response error code

vendor/github.com/aws/aws-sdk-go/service/organizations/doc.go

@@ -3,7 +3,53 @@
 // Package organizations provides the client and types for making API
 // requests to AWS Organizations.
 //
-// AWS Organizations
+// AWS Organizations is a web service that enables you to consolidate your multiple
+// AWS accounts into an organization and centrally manage your accounts and
+// their resources.
+//
+// This guide provides descriptions of the Organizations operations. For more
+// information about using this service, see the AWS Organizations User Guide
+// (http://docs.aws.amazon.com/organizations/latest/userguide/orgs_introduction.html).
+//
+// Support and feedback for AWS Organizations
+//
+// We welcome your feedback. Send your comments to feedback-awsorganizations@amazon.com
+// (mailto:feedback-awsorganizations@amazon.com) or post your feedback and questions
+// in the AWS Organizations support forum (http://forums.aws.amazon.com/forum.jspa?forumID=219).
+// For more information about the AWS support forums, see Forums Help (http://forums.aws.amazon.com/help.jspa).
+//
+// Endpoint to call When using the AWS CLI or the AWS SDK
+//
+// For the current release of Organizations, specify the us-east-1 region for
+// all AWS API and AWS CLI calls made from the commercial AWS Regions outside
+// of China. If calling from one of the AWS Regions in China, then specify cn-northwest-1.
+// You can do this in the AWS CLI by using these parameters and commands:
+//
+//    * Use the following parameter with each command to specify both the endpoint
+//    and its region: --endpoint-url https://organizations.us-east-1.amazonaws.com
+//    (from commercial AWS Regions outside of China) or --endpoint-url https://organizations.cn-northwest-1.amazonaws.com.cn
+//    (from AWS Regions in China)
+//
+//    * Use the default endpoint, but configure your default region with this
+//    command: aws configure set default.region us-east-1 (from commercial AWS
+//    Regions outside of China) or aws configure set default.region cn-northwest-1
+//    (from AWS Regions in China)
+//
+//    * Use the following parameter with each command to specify the endpoint:
+//    --region us-east-1 (from commercial AWS Regions outside of China) or --region
+//    cn-northwest-1 (from AWS Regions in China)
+//
+// Recording API Requests
+//
+// AWS Organizations supports AWS CloudTrail, a service that records AWS API
+// calls for your AWS account and delivers log files to an Amazon S3 bucket.
+// By using information collected by AWS CloudTrail, you can determine which
+// requests the Organizations service received, who made the request and when,
+// and so on. For more about AWS Organizations and its support for AWS CloudTrail,
+// see Logging AWS Organizations Events with AWS CloudTrail (https://docs.aws.amazon.com/organizations/latest/userguide/orgs_incident-response.html#orgs_cloudtrail-integration)
+// in the AWS Organizations User Guide. To learn more about AWS CloudTrail,
+// including how to turn it on and find your log files, see the AWS CloudTrail
+// User Guide (http://docs.aws.amazon.com/awscloudtrail/latest/userguide/what_is_cloud_trail_top_level.html).
 //
 // See https://docs.aws.amazon.com/goto/WebAPI/organizations-2016-11-28 for more information on this service.
 //

vendor/github.com/aws/aws-sdk-go/service/organizations/errors.go

@@ -96,7 +96,7 @@ const (
 	// Some of the reasons in the following list might not be applicable to this
 	// specific API or operation.
 	//
-	//    * ACCOUNT_CANNOT_LEAVE_ORGANIZAION: You attempted to remove the management
+	//    * ACCOUNT_CANNOT_LEAVE_ORGANIZATION: You attempted to remove the management
 	//    account from the organization. You can't remove the management account.
 	//    Instead, after you remove all member accounts, delete the organization
 	//    itself.
@@ -163,7 +163,7 @@ const (
 	//    with the same marketplace.
 	//
 	//    * MASTER_ACCOUNT_MISSING_BUSINESS_LICENSE: Applies only to the AWS Regions
-	//    in China. To create an organization, the master must have an valid business
+	//    in China. To create an organization, the master must have a valid business
 	//    license. For more information, contact customer support.
 	//
 	//    * MASTER_ACCOUNT_MISSING_CONTACT_INFO: To complete this operation, you
@@ -328,6 +328,10 @@ const (
 	//    * ORGANIZATION_ALREADY_HAS_ALL_FEATURES: The handshake request is invalid
 	//    because the organization has already enabled all features.
 	//
+	//    * ORGANIZATION_IS_ALREADY_PENDING_ALL_FEATURES_MIGRATION: The handshake
+	//    request is invalid because the organization has already started the process
+	//    to enable all features.
+	//
 	//    * ORGANIZATION_FROM_DIFFERENT_SELLER_OF_RECORD: The request failed because
 	//    the account is from a different marketplace than the accounts in the organization.
 	//    For example, accounts with India addresses must be associated with the
@@ -374,6 +378,9 @@ const (
 	//
 	//    * INPUT_REQUIRED: You must include a value for all required parameters.
 	//
+	//    * INVALID_EMAIL_ADDRESS_TARGET: You specified an invalid email address
+	//    for the invited account owner.
+	//
 	//    * INVALID_ENUM: You specified an invalid value.
 	//
 	//    * INVALID_ENUM_POLICY_TYPE: You specified an invalid policy type string.

vendor/github.com/aws/aws-sdk-go/service/route53/api.go

@@ -57,7 +57,7 @@ func (c *Route53) ActivateKeySigningKeyRequest(input *ActivateKeySigningKeyInput
 
 // ActivateKeySigningKey API operation for Amazon Route 53.
 //
-// Activates a key signing key (KSK) so that it can be used for signing by DNSSEC.
+// Activates a key-signing key (KSK) so that it can be used for signing by DNSSEC.
 // This operation changes the KSK status to ACTIVE.
 //
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
@@ -73,10 +73,10 @@ func (c *Route53) ActivateKeySigningKeyRequest(input *ActivateKeySigningKeyInput
 //   at the same time that you did. Retry the request.
 //
 //   * ErrCodeNoSuchKeySigningKey "NoSuchKeySigningKey"
-//   The specified key signing key (KSK) doesn't exist.
+//   The specified key-signing key (KSK) doesn't exist.
 //
 //   * ErrCodeInvalidKeySigningKeyStatus "InvalidKeySigningKeyStatus"
-//   The key signing key (KSK) status isn't valid or another KSK has the status
+//   The key-signing key (KSK) status isn't valid or another KSK has the status
 //   INTERNAL_FAILURE.
 //
 //   * ErrCodeInvalidSigningStatus "InvalidSigningStatus"
@@ -746,6 +746,9 @@ func (c *Route53) CreateHostedZoneRequest(input *CreateHostedZoneInput) (req *re
 // records are not yet available on all Route 53 DNS servers. When the NS and
 // SOA records are available, the status of the zone changes to INSYNC.
 //
+// The CreateHostedZone request requires the caller to have an ec2:DescribeVpcs
+// permission.
+//
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
 // with awserr.Error's Code and Message methods to get detailed information about
 // the error.
@@ -884,7 +887,7 @@ func (c *Route53) CreateKeySigningKeyRequest(input *CreateKeySigningKeyInput) (r
 
 // CreateKeySigningKey API operation for Amazon Route 53.
 //
-// Creates a new key signing key (KSK) associated with a hosted zone. You can
+// Creates a new key-signing key (KSK) associated with a hosted zone. You can
 // only have two KSKs per hosted zone.
 //
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
@@ -909,7 +912,7 @@ func (c *Route53) CreateKeySigningKeyRequest(input *CreateKeySigningKeyInput) (r
 //   signing.
 //
 //   * ErrCodeInvalidKeySigningKeyStatus "InvalidKeySigningKeyStatus"
-//   The key signing key (KSK) status isn't valid or another KSK has the status
+//   The key-signing key (KSK) status isn't valid or another KSK has the status
 //   INTERNAL_FAILURE.
 //
 //   * ErrCodeInvalidSigningStatus "InvalidSigningStatus"
@@ -917,14 +920,14 @@ func (c *Route53) CreateKeySigningKeyRequest(input *CreateKeySigningKeyInput) (r
 //   change the status to enable DNSSEC or disable DNSSEC.
 //
 //   * ErrCodeInvalidKeySigningKeyName "InvalidKeySigningKeyName"
-//   The key signing key (KSK) name that you specified isn't a valid name.
+//   The key-signing key (KSK) name that you specified isn't a valid name.
 //
 //   * ErrCodeKeySigningKeyAlreadyExists "KeySigningKeyAlreadyExists"
-//   You've already created a key signing key (KSK) with this name or with the
-//   same customer managed key (CMK) ARN.
+//   You've already created a key-signing key (KSK) with this name or with the
+//   same customer managed customer master key (CMK) ARN.
 //
 //   * ErrCodeTooManyKeySigningKeys "TooManyKeySigningKeys"
-//   You've reached the limit for the number of key signing keys (KSKs). Remove
+//   You've reached the limit for the number of key-signing keys (KSKs). Remove
 //   at least one KSK, and then try again.
 //
 //   * ErrCodeConcurrentModification "ConcurrentModification"
@@ -1780,7 +1783,7 @@ func (c *Route53) DeactivateKeySigningKeyRequest(input *DeactivateKeySigningKeyI
 
 // DeactivateKeySigningKey API operation for Amazon Route 53.
 //
-// Deactivates a key signing key (KSK) so that it will not be used for signing
+// Deactivates a key-signing key (KSK) so that it will not be used for signing
 // by DNSSEC. This operation changes the KSK status to INACTIVE.
 //
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
@@ -1796,10 +1799,10 @@ func (c *Route53) DeactivateKeySigningKeyRequest(input *DeactivateKeySigningKeyI
 //   at the same time that you did. Retry the request.
 //
 //   * ErrCodeNoSuchKeySigningKey "NoSuchKeySigningKey"
-//   The specified key signing key (KSK) doesn't exist.
+//   The specified key-signing key (KSK) doesn't exist.
 //
 //   * ErrCodeInvalidKeySigningKeyStatus "InvalidKeySigningKeyStatus"
-//   The key signing key (KSK) status isn't valid or another KSK has the status
+//   The key-signing key (KSK) status isn't valid or another KSK has the status
 //   INTERNAL_FAILURE.
 //
 //   * ErrCodeInvalidSigningStatus "InvalidSigningStatus"
@@ -1807,12 +1810,12 @@ func (c *Route53) DeactivateKeySigningKeyRequest(input *DeactivateKeySigningKeyI
 //   change the status to enable DNSSEC or disable DNSSEC.
 //
 //   * ErrCodeKeySigningKeyInUse "KeySigningKeyInUse"
-//   The key signing key (KSK) that you specified can't be deactivated because
+//   The key-signing key (KSK) that you specified can't be deactivated because
 //   it's the only KSK for a currently-enabled DNSSEC. Disable DNSSEC signing,
 //   or add or enable another KSK.
 //
 //   * ErrCodeKeySigningKeyInParentDSRecord "KeySigningKeyInParentDSRecord"
-//   The key signing key (KSK) is specified in a parent DS record.
+//   The key-signing key (KSK) is specified in a parent DS record.
 //
 // See also, https://docs.aws.amazon.com/goto/WebAPI/route53-2013-04-01/DeactivateKeySigningKey
 func (c *Route53) DeactivateKeySigningKey(input *DeactivateKeySigningKeyInput) (*DeactivateKeySigningKeyOutput, error) {
@@ -2120,8 +2123,8 @@ func (c *Route53) DeleteKeySigningKeyRequest(input *DeleteKeySigningKeyInput) (r
 
 // DeleteKeySigningKey API operation for Amazon Route 53.
 //
-// Deletes a key signing key (KSK). Before you can delete a KSK, you must deactivate
-// it. The KSK must be deactived before you can delete it regardless of whether
+// Deletes a key-signing key (KSK). Before you can delete a KSK, you must deactivate
+// it. The KSK must be deactivated before you can delete it regardless of whether
 // the hosted zone is enabled for DNSSEC signing.
 //
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
@@ -2137,10 +2140,10 @@ func (c *Route53) DeleteKeySigningKeyRequest(input *DeleteKeySigningKeyInput) (r
 //   at the same time that you did. Retry the request.
 //
 //   * ErrCodeNoSuchKeySigningKey "NoSuchKeySigningKey"
-//   The specified key signing key (KSK) doesn't exist.
+//   The specified key-signing key (KSK) doesn't exist.
 //
 //   * ErrCodeInvalidKeySigningKeyStatus "InvalidKeySigningKeyStatus"
-//   The key signing key (KSK) status isn't valid or another KSK has the status
+//   The key-signing key (KSK) status isn't valid or another KSK has the status
 //   INTERNAL_FAILURE.
 //
 //   * ErrCodeInvalidSigningStatus "InvalidSigningStatus"
@@ -2708,7 +2711,7 @@ func (c *Route53) DisableHostedZoneDNSSECRequest(input *DisableHostedZoneDNSSECI
 // DisableHostedZoneDNSSEC API operation for Amazon Route 53.
 //
 // Disables DNSSEC signing in a specific hosted zone. This action does not deactivate
-// any key signing keys (KSKs) that are active in the hosted zone.
+// any key-signing keys (KSKs) that are active in the hosted zone.
 //
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
 // with awserr.Error's Code and Message methods to get detailed information about
@@ -2729,13 +2732,13 @@ func (c *Route53) DisableHostedZoneDNSSECRequest(input *DisableHostedZoneDNSSECI
 //   at the same time that you did. Retry the request.
 //
 //   * ErrCodeKeySigningKeyInParentDSRecord "KeySigningKeyInParentDSRecord"
-//   The key signing key (KSK) is specified in a parent DS record.
+//   The key-signing key (KSK) is specified in a parent DS record.
 //
 //   * ErrCodeDNSSECNotFound "DNSSECNotFound"
 //   The hosted zone doesn't have any DNSSEC resources.
 //
 //   * ErrCodeInvalidKeySigningKeyStatus "InvalidKeySigningKeyStatus"
-//   The key signing key (KSK) status isn't valid or another KSK has the status
+//   The key-signing key (KSK) status isn't valid or another KSK has the status
 //   INTERNAL_FAILURE.
 //
 //   * ErrCodeInvalidKMSArn "InvalidKMSArn"
@@ -2941,7 +2944,7 @@ func (c *Route53) EnableHostedZoneDNSSECRequest(input *EnableHostedZoneDNSSECInp
 //   at the same time that you did. Retry the request.
 //
 //   * ErrCodeKeySigningKeyWithActiveStatusNotFound "KeySigningKeyWithActiveStatusNotFound"
-//   A key signing key (KSK) with ACTIVE status wasn't found.
+//   A key-signing key (KSK) with ACTIVE status wasn't found.
 //
 //   * ErrCodeInvalidKMSArn "InvalidKMSArn"
 //   The KeyManagementServiceArn that you specified isn't valid to use with DNSSEC
@@ -2955,7 +2958,7 @@ func (c *Route53) EnableHostedZoneDNSSECRequest(input *EnableHostedZoneDNSSECInp
 //   The hosted zone doesn't have any DNSSEC resources.
 //
 //   * ErrCodeInvalidKeySigningKeyStatus "InvalidKeySigningKeyStatus"
-//   The key signing key (KSK) status isn't valid or another KSK has the status
+//   The key-signing key (KSK) status isn't valid or another KSK has the status
 //   INTERNAL_FAILURE.
 //
 // See also, https://docs.aws.amazon.com/goto/WebAPI/route53-2013-04-01/EnableHostedZoneDNSSEC
@@ -3203,6 +3206,8 @@ func (c *Route53) GetCheckerIpRangesRequest(input *GetCheckerIpRangesInput) (req
 
 // GetCheckerIpRanges API operation for Amazon Route 53.
 //
+// Route 53 does not perform authorization for this API because it retrieves
+// information that is already available to the public.
 //
 // GetCheckerIpRanges still works, but we recommend that you download ip-ranges.json,
 // which includes IP address ranges for all AWS services. For more information,
@@ -3282,7 +3287,7 @@ func (c *Route53) GetDNSSECRequest(input *GetDNSSECInput) (req *request.Request,
 // GetDNSSEC API operation for Amazon Route 53.
 //
 // Returns information about DNSSEC for a specific hosted zone, including the
-// key signing keys (KSKs) and zone signing keys (ZSKs) in the hosted zone.
+// key-signing keys (KSKs) in the hosted zone.
 //
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
 // with awserr.Error's Code and Message methods to get detailed information about
@@ -3367,6 +3372,9 @@ func (c *Route53) GetGeoLocationRequest(input *GetGeoLocationInput) (req *reques
 // Gets information about whether a specified geographic location is supported
 // for Amazon Route 53 geolocation resource record sets.
 //
+// Route 53 does not perform authorization for this API because it retrieves
+// information that is already available to the public.
+//
 // Use the following syntax to determine whether a continent is supported for
 // geolocation:
 //
@@ -4557,6 +4565,9 @@ func (c *Route53) ListGeoLocationsRequest(input *ListGeoLocationsInput) (req *re
 // the subdivisions for that country are listed in alphabetical order immediately
 // after the corresponding country.
 //
+// Route 53 does not perform authorization for this API because it retrieves
+// information that is already available to the public.
+//
 // For a list of supported geolocation codes, see the GeoLocation (https://docs.aws.amazon.com/Route53/latest/APIReference/API_GeoLocation.html)
 // data type.
 //
@@ -5310,7 +5321,7 @@ func (c *Route53) ListResourceRecordSetsRequest(input *ListResourceRecordSetsInp
 //
 // Lists the resource record sets in a specified hosted zone.
 //
-// ListResourceRecordSets returns up to 100 resource record sets at a time in
+// ListResourceRecordSets returns up to 300 resource record sets at a time in
 // ASCII order, beginning at a position specified by the name and type elements.
 //
 // Sort order
@@ -6329,6 +6340,8 @@ func (c *Route53) TestDNSAnswerRequest(input *TestDNSAnswerInput) (req *request.
 // for a specified record name and type. You can optionally specify the IP address
 // of a DNS resolver, an EDNS0 client subnet IP address, and a subnet mask.
 //
+// This call only supports querying public hosted zones.
+//
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
 // with awserr.Error's Code and Message methods to get detailed information about
 // the error.
@@ -6801,7 +6814,9 @@ type ActivateKeySigningKeyInput struct {
 	// HostedZoneId is a required field
 	HostedZoneId *string `location:"uri" locationName:"HostedZoneId" type:"string" required:"true"`
 
-	// An alphanumeric string used to identify a key signing key (KSK).
+	// A string used to identify a key-signing key (KSK). Name can include numbers,
+	// letters, and underscores (_). Name must be unique for each key-signing key
+	// in the same hosted zone.
 	//
 	// Name is a required field
 	Name *string `location:"uri" locationName:"Name" min:"3" type:"string" required:"true"`
@@ -6902,8 +6917,9 @@ type AlarmIdentifier struct {
 	// determine whether this health check is healthy, the region that the alarm
 	// was created in.
 	//
-	// For the current list of CloudWatch regions, see Amazon CloudWatch (https://docs.aws.amazon.com/general/latest/gr/rande.html#cw_region)
-	// in the AWS Service Endpoints chapter of the Amazon Web Services General Reference.
+	// For the current list of CloudWatch regions, see Amazon CloudWatch endpoints
+	// and quotas (https://docs.aws.amazon.com/general/latest/gr/cw_region.html)
+	// in the Amazon Web Services General Reference.
 	//
 	// Region is a required field
 	Region *string `min:"1" type:"string" required:"true" enum:"CloudWatchRegion"`
@@ -7199,21 +7215,20 @@ type AliasTarget struct {
 	//
 	// Specify the hosted zone ID for the region that you created the environment
 	// in. The environment must have a regionalized subdomain. For a list of regions
-	// and the corresponding hosted zone IDs, see AWS Elastic Beanstalk (https://docs.aws.amazon.com/general/latest/gr/rande.html#elasticbeanstalk_region)
-	// in the "AWS Service Endpoints" chapter of the Amazon Web Services General
-	// Reference.
+	// and the corresponding hosted zone IDs, see AWS Elastic Beanstalk endpoints
+	// and quotas (https://docs.aws.amazon.com/general/latest/gr/elasticbeanstalk.html)
+	// in the the Amazon Web Services General Reference.
 	//
 	// ELB load balancer
 	//
 	// Specify the value of the hosted zone ID for the load balancer. Use the following
 	// methods to get the hosted zone ID:
 	//
-	//    * Service Endpoints (https://docs.aws.amazon.com/general/latest/gr/elb.html)
-	//    table in the "Elastic Load Balancing Endpoints and Quotas" topic in the
-	//    Amazon Web Services General Reference: Use the value that corresponds
-	//    with the region that you created your load balancer in. Note that there
-	//    are separate columns for Application and Classic Load Balancers and for
-	//    Network Load Balancers.
+	//    * Elastic Load Balancing endpoints and quotas (https://docs.aws.amazon.com/general/latest/gr/elb.html)
+	//    topic in the Amazon Web Services General Reference: Use the value that
+	//    corresponds with the region that you created your load balancer in. Note
+	//    that there are separate columns for Application and Classic Load Balancers
+	//    and for Network Load Balancers.
 	//
 	//    * AWS Management Console: Go to the Amazon EC2 page, choose Load Balancers
 	//    in the navigation pane, select the load balancer, and get the value of
@@ -8230,13 +8245,13 @@ type CreateKeySigningKeyInput struct {
 	// HostedZoneId is a required field
 	HostedZoneId *string `type:"string" required:"true"`
 
-	// The Amazon resource name (ARN) for a customer managed key (CMK) in AWS Key
-	// Management Service (KMS). The KeyManagementServiceArn must be unique for
-	// each key signing key (KSK) in a single hosted zone. To see an example of
-	// KeyManagementServiceArn that grants the correct permissions for DNSSEC, scroll
-	// down to Example.
+	// The Amazon resource name (ARN) for a customer managed customer master key
+	// (CMK) in AWS Key Management Service (AWS KMS). The KeyManagementServiceArn
+	// must be unique for each key-signing key (KSK) in a single hosted zone. To
+	// see an example of KeyManagementServiceArn that grants the correct permissions
+	// for DNSSEC, scroll down to Example.
 	//
-	// You must configure the CMK as follows:
+	// You must configure the customer managed CMK as follows:
 	//
 	// Status
 	//
@@ -8263,21 +8278,22 @@ type CreateKeySigningKeyInput struct {
 	// The key policy must also include the Amazon Route 53 service in the principal
 	// for your account. Specify the following:
 	//
-	//    * "Service": "api-service.dnssec.route53.aws.internal"
+	//    * "Service": "dnssec.route53.aws.amazonaws.com"
 	//
-	// For more information about working with CMK in KMS, see AWS Key Management
-	// Service concepts (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html).
+	// For more information about working with a customer managed CMK in AWS KMS,
+	// see AWS Key Management Service concepts (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html).
 	//
 	// KeyManagementServiceArn is a required field
 	KeyManagementServiceArn *string `type:"string" required:"true"`
 
-	// An alphanumeric string used to identify a key signing key (KSK). Name must
-	// be unique for each key signing key in the same hosted zone.
+	// A string used to identify a key-signing key (KSK). Name can include numbers,
+	// letters, and underscores (_). Name must be unique for each key-signing key
+	// in the same hosted zone.
 	//
 	// Name is a required field
 	Name *string `min:"3" type:"string" required:"true"`
 
-	// A string specifying the initial status of the key signing key (KSK). You
+	// A string specifying the initial status of the key-signing key (KSK). You
 	// can set the value to ACTIVE or INACTIVE.
 	//
 	// Status is a required field
@@ -8367,12 +8383,12 @@ type CreateKeySigningKeyOutput struct {
 	// ChangeInfo is a required field
 	ChangeInfo *ChangeInfo `type:"structure" required:"true"`
 
-	// The key signing key (KSK) that the request creates.
+	// The key-signing key (KSK) that the request creates.
 	//
 	// KeySigningKey is a required field
 	KeySigningKey *KeySigningKey `type:"structure" required:"true"`
 
-	// The unique URL representing the new key signing key (KSK).
+	// The unique URL representing the new key-signing key (KSK).
 	//
 	// Location is a required field
 	Location *string `location:"header" locationName:"Location" type:"string" required:"true"`
@@ -9059,14 +9075,34 @@ func (s *CreateVPCAssociationAuthorizationOutput) SetVPC(v *VPC) *CreateVPCAssoc
 type DNSSECStatus struct {
 	_ struct{} `type:"structure"`
 
-	// Indicates your hosted zone signging status: SIGNING, NOT_SIGNING, or INTERNAL_FAILURE.
-	// If the status is INTERNAL_FAILURE, see StatusMessage for information about
-	// steps that you can take to correct the problem.
+	// A string that represents the current hosted zone signing status.
 	//
-	// A status INTERNAL_FAILURE means there was an error during a request. Before
-	// you can continue to work with DNSSEC signing, including working with key
-	// signing keys (KSKs), you must correct the problem by enabling or disabling
-	// DNSSEC signing for the hosted zone.
+	// Status can have one of the following values:
+	//
+	// SIGNING
+	//
+	// DNSSEC signing is enabled for the hosted zone.
+	//
+	// NOT_SIGNING
+	//
+	// DNSSEC signing is not enabled for the hosted zone.
+	//
+	// DELETING
+	//
+	// DNSSEC signing is in the process of being removed for the hosted zone.
+	//
+	// ACTION_NEEDED
+	//
+	// There is a problem with signing in the hosted zone that requires you to take
+	// action to resolve. For example, the customer managed customer master key
+	// (CMK) might have been deleted, or the permissions for the customer managed
+	// CMK might have been changed.
+	//
+	// INTERNAL_FAILURE
+	//
+	// There was an error during a request. Before you can continue to work with
+	// DNSSEC signing, including with key-signing keys (KSKs), you must correct
+	// the problem by enabling or disabling DNSSEC signing for the hosted zone.
 	ServeSignature *string `min:"1" type:"string"`
 
 	// The status message provided for the following DNSSEC signing status: INTERNAL_FAILURE.
@@ -9105,7 +9141,7 @@ type DeactivateKeySigningKeyInput struct {
 	// HostedZoneId is a required field
 	HostedZoneId *string `location:"uri" locationName:"HostedZoneId" type:"string" required:"true"`
 
-	// An alphanumeric string used to identify a key signing key (KSK).
+	// A string used to identify a key-signing key (KSK).
 	//
 	// Name is a required field
 	Name *string `location:"uri" locationName:"Name" min:"3" type:"string" required:"true"`
@@ -9362,7 +9398,7 @@ type DeleteKeySigningKeyInput struct {
 	// HostedZoneId is a required field
 	HostedZoneId *string `location:"uri" locationName:"HostedZoneId" type:"string" required:"true"`
 
-	// An alphanumeric string used to identify a key signing key (KSK).
+	// A string used to identify a key-signing key (KSK).
 	//
 	// Name is a required field
 	Name *string `location:"uri" locationName:"Name" min:"3" type:"string" required:"true"`
@@ -10147,8 +10183,12 @@ type GeoLocationDetails struct {
 	// The name of the country.
 	CountryName *string `min:"1" type:"string"`
 
-	// The code for the subdivision. Route 53 currently supports only states in
-	// the United States.
+	// The code for the subdivision, such as a particular state within the United
+	// States. For a list of US state abbreviations, see Appendix B: Two–Letter
+	// State and Possession Abbreviations (https://pe.usps.com/text/pub28/28apb.htm)
+	// on the United States Postal Service website. For a list of all supported
+	// subdivision codes, use the ListGeoLocations (https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListGeoLocations.html)
+	// API.
 	SubdivisionCode *string `min:"1" type:"string"`
 
 	// The full name of the subdivision. Route 53 currently supports only states
@@ -10461,7 +10501,7 @@ func (s *GetDNSSECInput) SetHostedZoneId(v string) *GetDNSSECInput {
 type GetDNSSECOutput struct {
 	_ struct{} `type:"structure"`
 
-	// The key signing keys (KSKs) in your account.
+	// The key-signing keys (KSKs) in your account.
 	//
 	// KeySigningKeys is a required field
 	KeySigningKeys []*KeySigningKey `type:"list" required:"true"`
@@ -10521,12 +10561,12 @@ type GetGeoLocationInput struct {
 	// standard 3166-1 alpha-2 (https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2).
 	CountryCode *string `location:"querystring" locationName:"countrycode" min:"1" type:"string"`
 
-	// For SubdivisionCode, Amazon Route 53 supports only states of the United States.
-	// For a list of state abbreviations, see Appendix B: Two–Letter State and
-	// Possession Abbreviations (https://pe.usps.com/text/pub28/28apb.htm) on the
-	// United States Postal Service website.
-	//
-	// If you specify subdivisioncode, you must also specify US for CountryCode.
+	// The code for the subdivision, such as a particular state within the United
+	// States. For a list of US state abbreviations, see Appendix B: Two–Letter
+	// State and Possession Abbreviations (https://pe.usps.com/text/pub28/28apb.htm)
+	// on the United States Postal Service website. For a list of all supported
+	// subdivision codes, use the ListGeoLocations (https://docs.aws.amazon.com/Route53/latest/APIReference/API_ListGeoLocations.html)
+	// API.
 	SubdivisionCode *string `location:"querystring" locationName:"subdivisioncode" min:"1" type:"string"`
 }
 
@@ -11576,7 +11616,7 @@ type HealthCheck struct {
 	// HealthCheckVersion is a required field
 	HealthCheckVersion *int64 `min:"1" type:"long" required:"true"`
 
-	// The identifier that Amazon Route 53assigned to the health check when you
+	// The identifier that Amazon Route 53 assigned to the health check when you
 	// created it. When you add or update a resource record set, you use this value
 	// to specify which health check to use. The value can be up to 64 characters
 	// long.
@@ -12380,7 +12420,7 @@ func (s *HostedZoneSummary) SetOwner(v *HostedZoneOwner) *HostedZoneSummary {
 	return s
 }
 
-// A key signing key (KSK) is a complex type that represents a public/private
+// A key-signing key (KSK) is a complex type that represents a public/private
 // key pair. The private key is used to generate a digital signature for the
 // zone signing key (ZSK). The public key is stored in the DNS and is used to
 // authenticate the ZSK. A KSK is always associated with a hosted zone; it cannot
@@ -12388,7 +12428,7 @@ func (s *HostedZoneSummary) SetOwner(v *HostedZoneOwner) *HostedZoneSummary {
 type KeySigningKey struct {
 	_ struct{} `type:"structure"`
 
-	// The date when the key signing key (KSK) was created.
+	// The date when the key-signing key (KSK) was created.
 	CreatedDate *time.Time `type:"timestamp"`
 
 	// A string that represents a DNSKEY record.
@@ -12411,7 +12451,7 @@ type KeySigningKey struct {
 	// system.
 	DigestValue *string `type:"string"`
 
-	// An integer that specifies how the key is used. For key signing key (KSK),
+	// An integer that specifies how the key is used. For key-signing key (KSK),
 	// this value is always 257.
 	Flag *int64 `type:"integer"`
 
@@ -12419,9 +12459,9 @@ type KeySigningKey struct {
 	// used to calculate the value is described in RFC-4034 Appendix B (https://tools.ietf.org/rfc/rfc4034.txt).
 	KeyTag *int64 `type:"integer"`
 
-	// The Amazon resource name (ARN) used to identify the customer managed key
-	// (CMK) in AWS Key Management Service (KMS). The KmsArn must be unique for
-	// each key signing key (KSK) in a single hosted zone.
+	// The Amazon resource name (ARN) used to identify the customer managed customer
+	// master key (CMK) in AWS Key Management Service (AWS KMS). The KmsArn must
+	// be unique for each key-signing key (KSK) in a single hosted zone.
 	//
 	// You must configure the CMK as follows:
 	//
@@ -12452,15 +12492,16 @@ type KeySigningKey struct {
 	//
 	//    * "Service": "api-service.dnssec.route53.aws.internal"
 	//
-	// For more information about working with the customer managed key (CMK) in
-	// KMS, see AWS Key Management Service concepts (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html).
+	// For more information about working with the customer managed CMK in AWS KMS,
+	// see AWS Key Management Service concepts (https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html).
 	KmsArn *string `type:"string"`
 
-	// The last time that the key signing key (KSK) was changed.
+	// The last time that the key-signing key (KSK) was changed.
 	LastModifiedDate *time.Time `type:"timestamp"`
 
-	// An alphanumeric string used to identify a key signing key (KSK). Name must
-	// be unique for each key signing key in the same hosted zone.
+	// A string used to identify a key-signing key (KSK). Name can include numbers,
+	// letters, and underscores (_). Name must be unique for each key-signing key
+	// in the same hosted zone.
 	Name *string `min:"3" type:"string"`
 
 	// The public key, represented as a Base64 encoding, as required by RFC-4034
@@ -12475,7 +12516,7 @@ type KeySigningKey struct {
 	// the guidelines provided by RFC-8624 Section 3.1 (https://tools.ietf.org/html/rfc8624#section-3.1).
 	SigningAlgorithmType *int64 `type:"integer"`
 
-	// A string that represents the current key signing key (KSK) status.
+	// A string that represents the current key-signing key (KSK) status.
 	//
 	// Status can have one of the following values:
 	//
@@ -12487,9 +12528,16 @@ type KeySigningKey struct {
 	//
 	// The KSK is not being used for signing.
 	//
+	// DELETING
+	//
+	// The KSK is in the process of being deleted.
+	//
 	// ACTION_NEEDED
 	//
-	// There is an error in the KSK that requires you to take action to resolve.
+	// There is a problem with the KSK that requires you to take action to resolve.
+	// For example, the customer managed customer master key (CMK) might have been
+	// deleted, or the permissions for the customer managed CMK might have been
+	// changed.
 	//
 	// INTERNAL_FAILURE
 	//
@@ -12498,7 +12546,7 @@ type KeySigningKey struct {
 	// the problem. For example, you may need to activate or deactivate the KSK.
 	Status *string `min:"5" type:"string"`
 
-	// The status message provided for the following key signing key (KSK) statuses:
+	// The status message provided for the following key-signing key (KSK) statuses:
 	// ACTION_NEEDED or INTERNAL_FAILURE. The status message includes information
 	// about what the problem might be and steps that you can take to correct the
 	// issue.
@@ -15378,8 +15426,8 @@ type ResourceRecordSet struct {
 	// data is encoded for them, see Supported DNS Resource Record Types (https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/ResourceRecordTypes.html)
 	// in the Amazon Route 53 Developer Guide.
 	//
-	// Valid values for basic resource record sets: A | AAAA | CAA | CNAME | MX
-	// | NAPTR | NS | PTR | SOA | SPF | SRV | TXT
+	// Valid values for basic resource record sets: A | AAAA | CAA | CNAME | DS
+	// |MX | NAPTR | NS | PTR | SOA | SPF | SRV | TXT
 	//
 	// Values for weighted, latency, geolocation, and failover resource record sets:
 	// A | AAAA | CAA | CNAME | MX | NAPTR | PTR | SPF | SRV | TXT. When creating

vendor/github.com/aws/aws-sdk-go/service/route53/errors.go

@@ -199,13 +199,13 @@ const (
 	// ErrCodeInvalidKeySigningKeyName for service response error code
 	// "InvalidKeySigningKeyName".
 	//
-	// The key signing key (KSK) name that you specified isn't a valid name.
+	// The key-signing key (KSK) name that you specified isn't a valid name.
 	ErrCodeInvalidKeySigningKeyName = "InvalidKeySigningKeyName"
 
 	// ErrCodeInvalidKeySigningKeyStatus for service response error code
 	// "InvalidKeySigningKeyStatus".
 	//
-	// The key signing key (KSK) status isn't valid or another KSK has the status
+	// The key-signing key (KSK) status isn't valid or another KSK has the status
 	// INTERNAL_FAILURE.
 	ErrCodeInvalidKeySigningKeyStatus = "InvalidKeySigningKeyStatus"
 
@@ -240,20 +240,20 @@ const (
 	// ErrCodeKeySigningKeyAlreadyExists for service response error code
 	// "KeySigningKeyAlreadyExists".
 	//
-	// You've already created a key signing key (KSK) with this name or with the
-	// same customer managed key (CMK) ARN.
+	// You've already created a key-signing key (KSK) with this name or with the
+	// same customer managed customer master key (CMK) ARN.
 	ErrCodeKeySigningKeyAlreadyExists = "KeySigningKeyAlreadyExists"
 
 	// ErrCodeKeySigningKeyInParentDSRecord for service response error code
 	// "KeySigningKeyInParentDSRecord".
 	//
-	// The key signing key (KSK) is specified in a parent DS record.
+	// The key-signing key (KSK) is specified in a parent DS record.
 	ErrCodeKeySigningKeyInParentDSRecord = "KeySigningKeyInParentDSRecord"
 
 	// ErrCodeKeySigningKeyInUse for service response error code
 	// "KeySigningKeyInUse".
 	//
-	// The key signing key (KSK) that you specified can't be deactivated because
+	// The key-signing key (KSK) that you specified can't be deactivated because
 	// it's the only KSK for a currently-enabled DNSSEC. Disable DNSSEC signing,
 	// or add or enable another KSK.
 	ErrCodeKeySigningKeyInUse = "KeySigningKeyInUse"
@@ -261,7 +261,7 @@ const (
 	// ErrCodeKeySigningKeyWithActiveStatusNotFound for service response error code
 	// "KeySigningKeyWithActiveStatusNotFound".
 	//
-	// A key signing key (KSK) with ACTIVE status wasn't found.
+	// A key-signing key (KSK) with ACTIVE status wasn't found.
 	ErrCodeKeySigningKeyWithActiveStatusNotFound = "KeySigningKeyWithActiveStatusNotFound"
 
 	// ErrCodeLastVPCAssociation for service response error code
@@ -327,7 +327,7 @@ const (
 	// ErrCodeNoSuchKeySigningKey for service response error code
 	// "NoSuchKeySigningKey".
 	//
-	// The specified key signing key (KSK) doesn't exist.
+	// The specified key-signing key (KSK) doesn't exist.
 	ErrCodeNoSuchKeySigningKey = "NoSuchKeySigningKey"
 
 	// ErrCodeNoSuchQueryLoggingConfig for service response error code
@@ -428,7 +428,7 @@ const (
 	// ErrCodeTooManyKeySigningKeys for service response error code
 	// "TooManyKeySigningKeys".
 	//
-	// You've reached the limit for the number of key signing keys (KSKs). Remove
+	// You've reached the limit for the number of key-signing keys (KSKs). Remove
 	// at least one KSK, and then try again.
 	ErrCodeTooManyKeySigningKeys = "TooManyKeySigningKeys"
 

vendor/github.com/aws/aws-sdk-go/service/s3/customizations.go

@@ -48,6 +48,8 @@ func defaultInitRequestFn(r *request.Request) {
 		//	case opGetObject:
 		//		r.Handlers.Build.PushBack(askForTxEncodingAppendMD5)
 		//		r.Handlers.Unmarshal.PushBack(useMD5ValidationReader)
+	case opWriteGetObjectResponse:
+		r.Handlers.Build.PushFront(buildWriteGetObjectResponseEndpoint)
 	}
 }
 

vendor/github.com/aws/aws-sdk-go/service/s3/endpoint.go

@@ -1,6 +1,8 @@
 package s3
 
 import (
+	"fmt"
+	"github.com/aws/aws-sdk-go/aws/awserr"
 	"net/url"
 	"strings"
 
@@ -11,6 +13,13 @@ import (
 	"github.com/aws/aws-sdk-go/internal/s3shared/arn"
 )
 
+const (
+	s3Namespace              = "s3"
+	s3AccessPointNamespace   = "s3-accesspoint"
+	s3ObjectsLambdaNamespace = "s3-object-lambda"
+	s3OutpostsNamespace      = "s3-outposts"
+)
+
 // Used by shapes with members decorated as endpoint ARN.
 func parseEndpointARN(v string) (arn.Resource, error) {
 	return arn.ParseResource(v, accessPointResourceParser)
@@ -20,10 +29,14 @@ func accessPointResourceParser(a awsarn.ARN) (arn.Resource, error) {
 	resParts := arn.SplitResource(a.Resource)
 	switch resParts[0] {
 	case "accesspoint":
-		if a.Service != "s3" {
-			return arn.AccessPointARN{}, arn.InvalidARNError{ARN: a, Reason: "service is not s3"}
+		switch a.Service {
+		case s3Namespace:
+			return arn.ParseAccessPointResource(a, resParts[1:])
+		case s3ObjectsLambdaNamespace:
+			return parseS3ObjectLambdaAccessPointResource(a, resParts)
+		default:
+			return arn.AccessPointARN{}, arn.InvalidARNError{ARN: a, Reason: fmt.Sprintf("service is not %s or %s", s3Namespace, s3ObjectsLambdaNamespace)}
 		}
-		return arn.ParseAccessPointResource(a, resParts[1:])
 	case "outpost":
 		if a.Service != "s3-outposts" {
 			return arn.OutpostAccessPointARN{}, arn.InvalidARNError{ARN: a, Reason: "service is not s3-outposts"}
@@ -80,6 +93,25 @@ func parseOutpostAccessPointResource(a awsarn.ARN, resParts []string) (arn.Outpo
 	return outpostAccessPointARN, nil
 }
 
+func parseS3ObjectLambdaAccessPointResource(a awsarn.ARN, resParts []string) (arn.S3ObjectLambdaAccessPointARN, error) {
+	if a.Service != s3ObjectsLambdaNamespace {
+		return arn.S3ObjectLambdaAccessPointARN{}, arn.InvalidARNError{ARN: a, Reason: fmt.Sprintf("service is not %s", s3ObjectsLambdaNamespace)}
+	}
+
+	accessPointARN, err := arn.ParseAccessPointResource(a, resParts[1:])
+	if err != nil {
+		return arn.S3ObjectLambdaAccessPointARN{}, err
+	}
+
+	if len(accessPointARN.Region) == 0 {
+		return arn.S3ObjectLambdaAccessPointARN{}, arn.InvalidARNError{ARN: a, Reason: fmt.Sprintf("%s region not set", s3ObjectsLambdaNamespace)}
+	}
+
+	return arn.S3ObjectLambdaAccessPointARN{
+		AccessPointARN: accessPointARN,
+	}, nil
+}
+
 func endpointHandler(req *request.Request) {
 	endpoint, ok := req.Params.(endpointARNGetter)
 	if !ok || !endpoint.hasEndpointARN() {
@@ -98,7 +130,7 @@ func endpointHandler(req *request.Request) {
 		Request:  req,
 	}
 
-	if resReq.IsCrossPartition() {
+	if len(resReq.Request.ClientInfo.PartitionID) != 0 && resReq.IsCrossPartition() {
 		req.Error = s3shared.NewClientPartitionMismatchError(resource,
 			req.ClientInfo.PartitionID, aws.StringValue(req.Config.Region), nil)
 		return
@@ -110,21 +142,22 @@ func endpointHandler(req *request.Request) {
 		return
 	}
 
-	if resReq.HasCustomEndpoint() {
-		req.Error = s3shared.NewInvalidARNWithCustomEndpointError(resource, nil)
-		return
-	}
-
 	switch tv := resource.(type) {
 	case arn.AccessPointARN:
 		err = updateRequestAccessPointEndpoint(req, tv)
 		if err != nil {
 			req.Error = err
 		}
+	case arn.S3ObjectLambdaAccessPointARN:
+		err = updateRequestS3ObjectLambdaAccessPointEndpoint(req, tv)
+		if err != nil {
+			req.Error = err
+		}
 	case arn.OutpostAccessPointARN:
 		// outposts does not support FIPS regions
-		if resReq.ResourceConfiguredForFIPS() {
-			req.Error = s3shared.NewInvalidARNWithFIPSError(resource, nil)
+		if resReq.UseFIPS() {
+			req.Error = s3shared.NewFIPSConfigurationError(resource, req.ClientInfo.PartitionID,
+				aws.StringValue(req.Config.Region), nil)
 			return
 		}
 
@@ -155,8 +188,7 @@ func updateRequestAccessPointEndpoint(req *request.Request, accessPoint arn.Acce
 			req.ClientInfo.PartitionID, aws.StringValue(req.Config.Region), nil)
 	}
 
-	// Ignore the disable host prefix for access points since custom endpoints
-	// are not supported.
+	// Ignore the disable host prefix for access points
 	req.Config.DisableEndpointHostPrefix = aws.Bool(false)
 
 	if err := accessPointEndpointBuilder(accessPoint).build(req); err != nil {
@@ -168,6 +200,31 @@ func updateRequestAccessPointEndpoint(req *request.Request, accessPoint arn.Acce
 	return nil
 }
 
+func updateRequestS3ObjectLambdaAccessPointEndpoint(req *request.Request, accessPoint arn.S3ObjectLambdaAccessPointARN) error {
+	// DualStack not supported
+	if aws.BoolValue(req.Config.UseDualStack) {
+		return s3shared.NewClientConfiguredForDualStackError(accessPoint,
+			req.ClientInfo.PartitionID, aws.StringValue(req.Config.Region), nil)
+	}
+
+	// Accelerate not supported
+	if aws.BoolValue(req.Config.S3UseAccelerate) {
+		return s3shared.NewClientConfiguredForAccelerateError(accessPoint,
+			req.ClientInfo.PartitionID, aws.StringValue(req.Config.Region), nil)
+	}
+
+	// Ignore the disable host prefix for access points
+	req.Config.DisableEndpointHostPrefix = aws.Bool(false)
+
+	if err := s3ObjectLambdaAccessPointEndpointBuilder(accessPoint).build(req); err != nil {
+		return err
+	}
+
+	removeBucketFromPath(req.HTTPRequest.URL)
+
+	return nil
+}
+
 func updateRequestOutpostAccessPointEndpoint(req *request.Request, accessPoint arn.OutpostAccessPointARN) error {
 	// Accelerate not supported
 	if aws.BoolValue(req.Config.S3UseAccelerate) {
@@ -181,8 +238,7 @@ func updateRequestOutpostAccessPointEndpoint(req *request.Request, accessPoint a
 			req.ClientInfo.PartitionID, aws.StringValue(req.Config.Region), nil)
 	}
 
-	// Ignore the disable host prefix for access points since custom endpoints
-	// are not supported.
+	// Ignore the disable host prefix for access points
 	req.Config.DisableEndpointHostPrefix = aws.Bool(false)
 
 	if err := outpostAccessPointEndpointBuilder(accessPoint).build(req); err != nil {
@@ -199,3 +255,37 @@ func removeBucketFromPath(u *url.URL) {
 		u.Path = "/"
 	}
 }
+
+func buildWriteGetObjectResponseEndpoint(req *request.Request) {
+	// DualStack not supported
+	if aws.BoolValue(req.Config.UseDualStack) {
+		req.Error = awserr.New("ConfigurationError", "client configured for dualstack but not supported for operation", nil)
+		return
+	}
+
+	// Accelerate not supported
+	if aws.BoolValue(req.Config.S3UseAccelerate) {
+		req.Error = awserr.New("ConfigurationError", "client configured for accelerate but not supported for operation", nil)
+		return
+	}
+
+	signingName := s3ObjectsLambdaNamespace
+	signingRegion := req.ClientInfo.SigningRegion
+
+	if !hasCustomEndpoint(req) {
+		endpoint, err := resolveRegionalEndpoint(req, aws.StringValue(req.Config.Region), EndpointsID)
+		if err != nil {
+			req.Error = awserr.New(request.ErrCodeSerialization, "failed to resolve endpoint", err)
+			return
+		}
+		signingRegion = endpoint.SigningRegion
+
+		if err = updateRequestEndpoint(req, endpoint.URL); err != nil {
+			req.Error = err
+			return
+		}
+		updateS3HostPrefixForS3ObjectLambda(req)
+	}
+
+	redirectSigner(req, signingName, signingRegion)
+}

vendor/github.com/aws/aws-sdk-go/service/s3/endpoint_builder.go

@@ -22,6 +22,11 @@ const (
 	outpostAccessPointPrefixTemplate = accessPointPrefixTemplate + "{" + outpostPrefixLabel + "}."
 )
 
+// hasCustomEndpoint returns true if endpoint is a custom endpoint
+func hasCustomEndpoint(r *request.Request) bool {
+	return len(aws.StringValue(r.Config.Endpoint)) > 0
+}
+
 // accessPointEndpointBuilder represents the endpoint builder for access point arn
 type accessPointEndpointBuilder arn.AccessPointARN
 
@@ -55,16 +60,15 @@ func (a accessPointEndpointBuilder) build(req *request.Request) error {
 			req.ClientInfo.PartitionID, cfgRegion, err)
 	}
 
-	if err = updateRequestEndpoint(req, endpoint.URL); err != nil {
-		return err
-	}
+	endpoint.URL = endpoints.AddScheme(endpoint.URL, aws.BoolValue(req.Config.DisableSSL))
 
-	const serviceEndpointLabel = "s3-accesspoint"
+	if !hasCustomEndpoint(req) {
+		if err = updateRequestEndpoint(req, endpoint.URL); err != nil {
+			return err
+		}
 
-	// dual stack provided by endpoint resolver
-	cfgHost := req.HTTPRequest.URL.Host
-	if strings.HasPrefix(cfgHost, "s3") {
-		req.HTTPRequest.URL.Host = serviceEndpointLabel + cfgHost[2:]
+		// dual stack provided by endpoint resolver
+		updateS3HostForS3AccessPoint(req)
 	}
 
 	protocol.HostPrefixBuilder{
@@ -90,6 +94,73 @@ func (a accessPointEndpointBuilder) hostPrefixLabelValues() map[string]string {
 	}
 }
 
+// s3ObjectLambdaAccessPointEndpointBuilder represents the endpoint builder for an s3 object lambda access point arn
+type s3ObjectLambdaAccessPointEndpointBuilder arn.S3ObjectLambdaAccessPointARN
+
+// build builds the endpoint for corresponding access point arn
+//
+// For building an endpoint from access point arn, format used is:
+// - Access point endpoint format : {accesspointName}-{accountId}.s3-object-lambda.{region}.{dnsSuffix}
+// - example : myaccesspoint-012345678901.s3-object-lambda.us-west-2.amazonaws.com
+//
+// Access Point Endpoint requests are signed using "s3-object-lambda" as signing name.
+//
+func (a s3ObjectLambdaAccessPointEndpointBuilder) build(req *request.Request) error {
+	resolveRegion := arn.S3ObjectLambdaAccessPointARN(a).Region
+	cfgRegion := aws.StringValue(req.Config.Region)
+
+	if s3shared.IsFIPS(cfgRegion) {
+		if aws.BoolValue(req.Config.S3UseARNRegion) && s3shared.IsCrossRegion(req, resolveRegion) {
+			// FIPS with cross region is not supported, the SDK must fail
+			// because there is no well defined method for SDK to construct a
+			// correct FIPS endpoint.
+			return s3shared.NewClientConfiguredForCrossRegionFIPSError(arn.S3ObjectLambdaAccessPointARN(a),
+				req.ClientInfo.PartitionID, cfgRegion, nil)
+		}
+		resolveRegion = cfgRegion
+	}
+
+	endpoint, err := resolveRegionalEndpoint(req, resolveRegion, EndpointsID)
+	if err != nil {
+		return s3shared.NewFailedToResolveEndpointError(arn.S3ObjectLambdaAccessPointARN(a),
+			req.ClientInfo.PartitionID, cfgRegion, err)
+	}
+
+	endpoint.URL = endpoints.AddScheme(endpoint.URL, aws.BoolValue(req.Config.DisableSSL))
+
+	endpoint.SigningName = s3ObjectsLambdaNamespace
+
+	if !hasCustomEndpoint(req) {
+		if err = updateRequestEndpoint(req, endpoint.URL); err != nil {
+			return err
+		}
+
+		updateS3HostPrefixForS3ObjectLambda(req)
+	}
+
+	protocol.HostPrefixBuilder{
+		Prefix:   accessPointPrefixTemplate,
+		LabelsFn: a.hostPrefixLabelValues,
+	}.Build(req)
+
+	// signer redirection
+	redirectSigner(req, endpoint.SigningName, endpoint.SigningRegion)
+
+	err = protocol.ValidateEndpointHost(req.Operation.Name, req.HTTPRequest.URL.Host)
+	if err != nil {
+		return s3shared.NewInvalidARNError(arn.S3ObjectLambdaAccessPointARN(a), err)
+	}
+
+	return nil
+}
+
+func (a s3ObjectLambdaAccessPointEndpointBuilder) hostPrefixLabelValues() map[string]string {
+	return map[string]string{
+		accessPointPrefixLabel: arn.S3ObjectLambdaAccessPointARN(a).AccessPointName,
+		accountIDPrefixLabel:   arn.S3ObjectLambdaAccessPointARN(a).AccountID,
+	}
+}
+
 // outpostAccessPointEndpointBuilder represents the Endpoint builder for outpost access point arn.
 type outpostAccessPointEndpointBuilder arn.OutpostAccessPointARN
 
@@ -106,7 +177,7 @@ func (o outpostAccessPointEndpointBuilder) build(req *request.Request) error {
 	resolveService := o.Service
 
 	endpointsID := resolveService
-	if resolveService == "s3-outposts" {
+	if resolveService == s3OutpostsNamespace {
 		endpointsID = "s3"
 	}
 
@@ -116,14 +187,13 @@ func (o outpostAccessPointEndpointBuilder) build(req *request.Request) error {
 			req.ClientInfo.PartitionID, resolveRegion, err)
 	}
 
-	if err = updateRequestEndpoint(req, endpoint.URL); err != nil {
-		return err
-	}
+	endpoint.URL = endpoints.AddScheme(endpoint.URL, aws.BoolValue(req.Config.DisableSSL))
 
-	// add url host as s3-outposts
-	cfgHost := req.HTTPRequest.URL.Host
-	if strings.HasPrefix(cfgHost, endpointsID) {
-		req.HTTPRequest.URL.Host = resolveService + cfgHost[len(endpointsID):]
+	if !hasCustomEndpoint(req) {
+		if err = updateRequestEndpoint(req, endpoint.URL); err != nil {
+			return err
+		}
+		updateHostPrefix(req, endpointsID, resolveService)
 	}
 
 	protocol.HostPrefixBuilder{
@@ -159,8 +229,6 @@ func resolveRegionalEndpoint(r *request.Request, region string, endpointsID stri
 }
 
 func updateRequestEndpoint(r *request.Request, endpoint string) (err error) {
-	endpoint = endpoints.AddScheme(endpoint, aws.BoolValue(r.Config.DisableSSL))
-
 	r.HTTPRequest.URL, err = url.Parse(endpoint + r.Operation.HTTPPath)
 	if err != nil {
 		return awserr.New(request.ErrCodeSerialization,
@@ -175,3 +243,19 @@ func redirectSigner(req *request.Request, signingName string, signingRegion stri
 	req.ClientInfo.SigningName = signingName
 	req.ClientInfo.SigningRegion = signingRegion
 }
+
+func updateS3HostForS3AccessPoint(req *request.Request) {
+	updateHostPrefix(req, "s3", s3AccessPointNamespace)
+}
+
+func updateS3HostPrefixForS3ObjectLambda(req *request.Request) {
+	updateHostPrefix(req, "s3", s3ObjectsLambdaNamespace)
+}
+
+func updateHostPrefix(req *request.Request, oldEndpointPrefix, newEndpointPrefix string) {
+	host := req.HTTPRequest.URL.Host
+	if strings.HasPrefix(host, oldEndpointPrefix) {
+		// replace service hostlabel oldEndpointPrefix to newEndpointPrefix
+		req.HTTPRequest.URL.Host = newEndpointPrefix + host[len(oldEndpointPrefix):]
+	}
+}

vendor/github.com/aws/aws-sdk-go/service/s3/errors.go

@@ -48,13 +48,13 @@ const (
 	// ErrCodeObjectAlreadyInActiveTierError for service response error code
 	// "ObjectAlreadyInActiveTierError".
 	//
-	// This operation is not allowed against this storage tier.
+	// This action is not allowed against this storage tier.
 	ErrCodeObjectAlreadyInActiveTierError = "ObjectAlreadyInActiveTierError"
 
 	// ErrCodeObjectNotInActiveTierError for service response error code
 	// "ObjectNotInActiveTierError".
 	//
-	// The source object of the COPY operation is not in the active tier and is
-	// only stored in Amazon S3 Glacier.
+	// The source object of the COPY action is not in the active tier and is only
+	// stored in Amazon S3 Glacier.
 	ErrCodeObjectNotInActiveTierError = "ObjectNotInActiveTierError"
 )

vendor/github.com/aws/aws-sdk-go/service/s3/service.go

@@ -48,6 +48,9 @@ const (
 //     svc := s3.New(mySession, aws.NewConfig().WithRegion("us-west-2"))
 func New(p client.ConfigProvider, cfgs ...*aws.Config) *S3 {
 	c := p.ClientConfig(EndpointsID, cfgs...)
+	if c.SigningNameDerived || len(c.SigningName) == 0 {
+		c.SigningName = "s3"
+	}
 	return newClient(*c.Config, c.Handlers, c.PartitionID, c.Endpoint, c.SigningRegion, c.SigningName)
 }
 

vendor/github.com/aws/aws-sdk-go/service/sso/doc.go

@@ -0,0 +1,44 @@
+// Code generated by private/model/cli/gen-api/main.go. DO NOT EDIT.
+
+// Package sso provides the client and types for making API
+// requests to AWS Single Sign-On.
+//
+// AWS Single Sign-On Portal is a web service that makes it easy for you to
+// assign user access to AWS SSO resources such as the user portal. Users can
+// get AWS account applications and roles assigned to them and get federated
+// into the application.
+//
+// For general information about AWS SSO, see What is AWS Single Sign-On? (https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html)
+// in the AWS SSO User Guide.
+//
+// This API reference guide describes the AWS SSO Portal operations that you
+// can call programatically and includes detailed information on data types
+// and errors.
+//
+// AWS provides SDKs that consist of libraries and sample code for various programming
+// languages and platforms, such as Java, Ruby, .Net, iOS, or Android. The SDKs
+// provide a convenient way to create programmatic access to AWS SSO and other
+// AWS services. For more information about the AWS SDKs, including how to download
+// and install them, see Tools for Amazon Web Services (http://aws.amazon.com/tools/).
+//
+// See https://docs.aws.amazon.com/goto/WebAPI/sso-2019-06-10 for more information on this service.
+//
+// See sso package documentation for more information.
+// https://docs.aws.amazon.com/sdk-for-go/api/service/sso/
+//
+// Using the Client
+//
+// To contact AWS Single Sign-On with the SDK use the New function to create
+// a new service client. With that client you can make API requests to the service.
+// These clients are safe to use concurrently.
+//
+// See the SDK's documentation for more information on how to use the SDK.
+// https://docs.aws.amazon.com/sdk-for-go/api/
+//
+// See aws.Config documentation for more information on configuring SDK clients.
+// https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config
+//
+// See the AWS Single Sign-On client SSO for more
+// information on creating client for this service.
+// https://docs.aws.amazon.com/sdk-for-go/api/service/sso/#New
+package sso

vendor/github.com/aws/aws-sdk-go/service/sso/errors.go

@@ -0,0 +1,44 @@
+// Code generated by private/model/cli/gen-api/main.go. DO NOT EDIT.
+
+package sso
+
+import (
+	"github.com/aws/aws-sdk-go/private/protocol"
+)
+
+const (
+
+	// ErrCodeInvalidRequestException for service response error code
+	// "InvalidRequestException".
+	//
+	// Indicates that a problem occurred with the input to the request. For example,
+	// a required parameter might be missing or out of range.
+	ErrCodeInvalidRequestException = "InvalidRequestException"
+
+	// ErrCodeResourceNotFoundException for service response error code
+	// "ResourceNotFoundException".
+	//
+	// The specified resource doesn't exist.
+	ErrCodeResourceNotFoundException = "ResourceNotFoundException"
+
+	// ErrCodeTooManyRequestsException for service response error code
+	// "TooManyRequestsException".
+	//
+	// Indicates that the request is being made too frequently and is more than
+	// what the server can handle.
+	ErrCodeTooManyRequestsException = "TooManyRequestsException"
+
+	// ErrCodeUnauthorizedException for service response error code
+	// "UnauthorizedException".
+	//
+	// Indicates that the request is not authorized. This can happen due to an invalid
+	// access token in the request.
+	ErrCodeUnauthorizedException = "UnauthorizedException"
+)
+
+var exceptionFromCode = map[string]func(protocol.ResponseMetadata) error{
+	"InvalidRequestException":   newErrorInvalidRequestException,
+	"ResourceNotFoundException": newErrorResourceNotFoundException,
+	"TooManyRequestsException":  newErrorTooManyRequestsException,
+	"UnauthorizedException":     newErrorUnauthorizedException,
+}

vendor/github.com/aws/aws-sdk-go/service/sso/service.go

@@ -0,0 +1,104 @@
+// Code generated by private/model/cli/gen-api/main.go. DO NOT EDIT.
+
+package sso
+
+import (
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/client"
+	"github.com/aws/aws-sdk-go/aws/client/metadata"
+	"github.com/aws/aws-sdk-go/aws/request"
+	"github.com/aws/aws-sdk-go/aws/signer/v4"
+	"github.com/aws/aws-sdk-go/private/protocol"
+	"github.com/aws/aws-sdk-go/private/protocol/restjson"
+)
+
+// SSO provides the API operation methods for making requests to
+// AWS Single Sign-On. See this package's package overview docs
+// for details on the service.
+//
+// SSO methods are safe to use concurrently. It is not safe to
+// modify mutate any of the struct's properties though.
+type SSO struct {
+	*client.Client
+}
+
+// Used for custom client initialization logic
+var initClient func(*client.Client)
+
+// Used for custom request initialization logic
+var initRequest func(*request.Request)
+
+// Service information constants
+const (
+	ServiceName = "SSO"        // Name of service.
+	EndpointsID = "portal.sso" // ID to lookup a service endpoint with.
+	ServiceID   = "SSO"        // ServiceID is a unique identifier of a specific service.
+)
+
+// New creates a new instance of the SSO client with a session.
+// If additional configuration is needed for the client instance use the optional
+// aws.Config parameter to add your extra config.
+//
+// Example:
+//     mySession := session.Must(session.NewSession())
+//
+//     // Create a SSO client from just a session.
+//     svc := sso.New(mySession)
+//
+//     // Create a SSO client with additional configuration
+//     svc := sso.New(mySession, aws.NewConfig().WithRegion("us-west-2"))
+func New(p client.ConfigProvider, cfgs ...*aws.Config) *SSO {
+	c := p.ClientConfig(EndpointsID, cfgs...)
+	if c.SigningNameDerived || len(c.SigningName) == 0 {
+		c.SigningName = "awsssoportal"
+	}
+	return newClient(*c.Config, c.Handlers, c.PartitionID, c.Endpoint, c.SigningRegion, c.SigningName)
+}
+
+// newClient creates, initializes and returns a new service client instance.
+func newClient(cfg aws.Config, handlers request.Handlers, partitionID, endpoint, signingRegion, signingName string) *SSO {
+	svc := &SSO{
+		Client: client.New(
+			cfg,
+			metadata.ClientInfo{
+				ServiceName:   ServiceName,
+				ServiceID:     ServiceID,
+				SigningName:   signingName,
+				SigningRegion: signingRegion,
+				PartitionID:   partitionID,
+				Endpoint:      endpoint,
+				APIVersion:    "2019-06-10",
+			},
+			handlers,
+		),
+	}
+
+	// Handlers
+	svc.Handlers.Sign.PushBackNamed(v4.SignRequestHandler)
+	svc.Handlers.Build.PushBackNamed(restjson.BuildHandler)
+	svc.Handlers.Unmarshal.PushBackNamed(restjson.UnmarshalHandler)
+	svc.Handlers.UnmarshalMeta.PushBackNamed(restjson.UnmarshalMetaHandler)
+	svc.Handlers.UnmarshalError.PushBackNamed(
+		protocol.NewUnmarshalErrorHandler(restjson.NewUnmarshalTypedError(exceptionFromCode)).NamedHandler(),
+	)
+
+	// Run custom client initialization if present
+	if initClient != nil {
+		initClient(svc.Client)
+	}
+
+	return svc
+}
+
+// newRequest creates a new request for a SSO operation and runs any
+// custom request initialization.
+func (c *SSO) newRequest(op *request.Operation, params, data interface{}) *request.Request {
+	req := c.NewRequest(op, params, data)
+
+	// Run custom request initialization if present
+	if initRequest != nil {
+		initRequest(req)
+	}
+
+	return req
+}

vendor/github.com/aws/aws-sdk-go/service/sso/ssoiface/interface.go

@@ -0,0 +1,86 @@
+// Code generated by private/model/cli/gen-api/main.go. DO NOT EDIT.
+
+// Package ssoiface provides an interface to enable mocking the AWS Single Sign-On service client
+// for testing your code.
+//
+// It is important to note that this interface will have breaking changes
+// when the service model is updated and adds new API operations, paginators,
+// and waiters.
+package ssoiface
+
+import (
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/request"
+	"github.com/aws/aws-sdk-go/service/sso"
+)
+
+// SSOAPI provides an interface to enable mocking the
+// sso.SSO service client's API operation,
+// paginators, and waiters. This make unit testing your code that calls out
+// to the SDK's service client's calls easier.
+//
+// The best way to use this interface is so the SDK's service client's calls
+// can be stubbed out for unit testing your code with the SDK without needing
+// to inject custom request handlers into the SDK's request pipeline.
+//
+//    // myFunc uses an SDK service client to make a request to
+//    // AWS Single Sign-On.
+//    func myFunc(svc ssoiface.SSOAPI) bool {
+//        // Make svc.GetRoleCredentials request
+//    }
+//
+//    func main() {
+//        sess := session.New()
+//        svc := sso.New(sess)
+//
+//        myFunc(svc)
+//    }
+//
+// In your _test.go file:
+//
+//    // Define a mock struct to be used in your unit tests of myFunc.
+//    type mockSSOClient struct {
+//        ssoiface.SSOAPI
+//    }
+//    func (m *mockSSOClient) GetRoleCredentials(input *sso.GetRoleCredentialsInput) (*sso.GetRoleCredentialsOutput, error) {
+//        // mock response/functionality
+//    }
+//
+//    func TestMyFunc(t *testing.T) {
+//        // Setup Test
+//        mockSvc := &mockSSOClient{}
+//
+//        myfunc(mockSvc)
+//
+//        // Verify myFunc's functionality
+//    }
+//
+// It is important to note that this interface will have breaking changes
+// when the service model is updated and adds new API operations, paginators,
+// and waiters. Its suggested to use the pattern above for testing, or using
+// tooling to generate mocks to satisfy the interfaces.
+type SSOAPI interface {
+	GetRoleCredentials(*sso.GetRoleCredentialsInput) (*sso.GetRoleCredentialsOutput, error)
+	GetRoleCredentialsWithContext(aws.Context, *sso.GetRoleCredentialsInput, ...request.Option) (*sso.GetRoleCredentialsOutput, error)
+	GetRoleCredentialsRequest(*sso.GetRoleCredentialsInput) (*request.Request, *sso.GetRoleCredentialsOutput)
+
+	ListAccountRoles(*sso.ListAccountRolesInput) (*sso.ListAccountRolesOutput, error)
+	ListAccountRolesWithContext(aws.Context, *sso.ListAccountRolesInput, ...request.Option) (*sso.ListAccountRolesOutput, error)
+	ListAccountRolesRequest(*sso.ListAccountRolesInput) (*request.Request, *sso.ListAccountRolesOutput)
+
+	ListAccountRolesPages(*sso.ListAccountRolesInput, func(*sso.ListAccountRolesOutput, bool) bool) error
+	ListAccountRolesPagesWithContext(aws.Context, *sso.ListAccountRolesInput, func(*sso.ListAccountRolesOutput, bool) bool, ...request.Option) error
+
+	ListAccounts(*sso.ListAccountsInput) (*sso.ListAccountsOutput, error)
+	ListAccountsWithContext(aws.Context, *sso.ListAccountsInput, ...request.Option) (*sso.ListAccountsOutput, error)
+	ListAccountsRequest(*sso.ListAccountsInput) (*request.Request, *sso.ListAccountsOutput)
+
+	ListAccountsPages(*sso.ListAccountsInput, func(*sso.ListAccountsOutput, bool) bool) error
+	ListAccountsPagesWithContext(aws.Context, *sso.ListAccountsInput, func(*sso.ListAccountsOutput, bool) bool, ...request.Option) error
+
+	Logout(*sso.LogoutInput) (*sso.LogoutOutput, error)
+	LogoutWithContext(aws.Context, *sso.LogoutInput, ...request.Option) (*sso.LogoutOutput, error)
+	LogoutRequest(*sso.LogoutInput) (*request.Request, *sso.LogoutOutput)
+}
+
+var _ SSOAPI = (*sso.SSO)(nil)

vendor/github.com/aws/aws-sdk-go/service/sts/api.go

@@ -65,34 +65,6 @@ func (c *STS) AssumeRoleRequest(input *AssumeRoleInput) (req *request.Request, o
 // and Comparing the AWS STS API operations (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison)
 // in the IAM User Guide.
 //
-// You cannot use AWS account root user credentials to call AssumeRole. You
-// must use credentials for an IAM user or an IAM role to call AssumeRole.
-//
-// For cross-account access, imagine that you own multiple accounts and need
-// to access resources in each account. You could create long-term credentials
-// in each account to access those resources. However, managing all those credentials
-// and remembering which one can access which account can be time consuming.
-// Instead, you can create one set of long-term credentials in one account.
-// Then use temporary security credentials to access all the other accounts
-// by assuming roles in those accounts. For more information about roles, see
-// IAM Roles (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html)
-// in the IAM User Guide.
-//
-// Session Duration
-//
-// By default, the temporary security credentials created by AssumeRole last
-// for one hour. However, you can use the optional DurationSeconds parameter
-// to specify the duration of your session. You can provide a value from 900
-// seconds (15 minutes) up to the maximum session duration setting for the role.
-// This setting can have a value from 1 hour to 12 hours. To learn how to view
-// the maximum value for your role, see View the Maximum Session Duration Setting
-// for a Role (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html#id_roles_use_view-role-max-session)
-// in the IAM User Guide. The maximum session duration limit applies when you
-// use the AssumeRole* API operations or the assume-role* CLI commands. However
-// the limit does not apply when you use those operations to create a console
-// URL. For more information, see Using IAM Roles (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html)
-// in the IAM User Guide.
-//
 // Permissions
 //
 // The temporary security credentials created by AssumeRole can be used to make
@@ -102,7 +74,7 @@ func (c *STS) AssumeRoleRequest(input *AssumeRoleInput) (req *request.Request, o
 // (Optional) You can pass inline or managed session policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
 // to this operation. You can pass a single JSON policy document to use as an
 // inline session policy. You can also specify up to 10 managed policies to
-// use as managed session policies. The plain text that you use for both inline
+// use as managed session policies. The plaintext that you use for both inline
 // and managed session policies can't exceed 2,048 characters. Passing policies
 // to this operation returns new temporary credentials. The resulting session's
 // permissions are the intersection of the role's identity-based policy and
@@ -308,6 +280,15 @@ func (c *STS) AssumeRoleWithSAMLRequest(input *AssumeRoleWithSAMLInput) (req *re
 // URL. For more information, see Using IAM Roles (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html)
 // in the IAM User Guide.
 //
+// Role chaining (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-role-chaining)
+// limits your AWS CLI or AWS API role session to a maximum of one hour. When
+// you use the AssumeRole API operation to assume a role, you can specify the
+// duration of your role session with the DurationSeconds parameter. You can
+// specify a parameter value of up to 43200 seconds (12 hours), depending on
+// the maximum session duration setting for your role. However, if you assume
+// a role using role chaining and provide a DurationSeconds parameter value
+// greater than one hour, the operation fails.
+//
 // Permissions
 //
 // The temporary security credentials created by AssumeRoleWithSAML can be used
@@ -317,7 +298,7 @@ func (c *STS) AssumeRoleWithSAMLRequest(input *AssumeRoleWithSAMLInput) (req *re
 // (Optional) You can pass inline or managed session policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
 // to this operation. You can pass a single JSON policy document to use as an
 // inline session policy. You can also specify up to 10 managed policies to
-// use as managed session policies. The plain text that you use for both inline
+// use as managed session policies. The plaintext that you use for both inline
 // and managed session policies can't exceed 2,048 characters. Passing policies
 // to this operation returns new temporary credentials. The resulting session's
 // permissions are the intersection of the role's identity-based policy and
@@ -346,16 +327,16 @@ func (c *STS) AssumeRoleWithSAMLRequest(input *AssumeRoleWithSAMLInput) (req *re
 // in STS (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html)
 // in the IAM User Guide.
 //
-// You can pass up to 50 session tags. The plain text session tag keys can’t
+// You can pass up to 50 session tags. The plaintext session tag keys can’t
 // exceed 128 characters and the values can’t exceed 256 characters. For these
 // and additional limits, see IAM and STS Character Limits (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length)
 // in the IAM User Guide.
 //
 // An AWS conversion compresses the passed session policies and session tags
 // into a packed binary format that has a separate limit. Your request can fail
-// for this limit even if your plain text meets the other requirements. The
-// PackedPolicySize response element indicates by percentage how close the policies
-// and tags for your request are to the upper size limit.
+// for this limit even if your plaintext meets the other requirements. The PackedPolicySize
+// response element indicates by percentage how close the policies and tags
+// for your request are to the upper size limit.
 //
 // You can pass a session tag with the same key as a tag that is attached to
 // the role. When you do, session tags override the role's tags with the same
@@ -564,7 +545,7 @@ func (c *STS) AssumeRoleWithWebIdentityRequest(input *AssumeRoleWithWebIdentityI
 // (Optional) You can pass inline or managed session policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
 // to this operation. You can pass a single JSON policy document to use as an
 // inline session policy. You can also specify up to 10 managed policies to
-// use as managed session policies. The plain text that you use for both inline
+// use as managed session policies. The plaintext that you use for both inline
 // and managed session policies can't exceed 2,048 characters. Passing policies
 // to this operation returns new temporary credentials. The resulting session's
 // permissions are the intersection of the role's identity-based policy and
@@ -583,16 +564,16 @@ func (c *STS) AssumeRoleWithWebIdentityRequest(input *AssumeRoleWithWebIdentityI
 // in STS (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html)
 // in the IAM User Guide.
 //
-// You can pass up to 50 session tags. The plain text session tag keys can’t
+// You can pass up to 50 session tags. The plaintext session tag keys can’t
 // exceed 128 characters and the values can’t exceed 256 characters. For these
 // and additional limits, see IAM and STS Character Limits (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length)
 // in the IAM User Guide.
 //
 // An AWS conversion compresses the passed session policies and session tags
 // into a packed binary format that has a separate limit. Your request can fail
-// for this limit even if your plain text meets the other requirements. The
-// PackedPolicySize response element indicates by percentage how close the policies
-// and tags for your request are to the upper size limit.
+// for this limit even if your plaintext meets the other requirements. The PackedPolicySize
+// response element indicates by percentage how close the policies and tags
+// for your request are to the upper size limit.
 //
 // You can pass a session tag with the same key as a tag that is attached to
 // the role. When you do, the session tag overrides the role tag with the same
@@ -619,7 +600,7 @@ func (c *STS) AssumeRoleWithWebIdentityRequest(input *AssumeRoleWithWebIdentityI
 //
 // Calling AssumeRoleWithWebIdentity can result in an entry in your AWS CloudTrail
 // logs. The entry includes the Subject (http://openid.net/specs/openid-connect-core-1_0.html#Claims)
-// of the provided Web Identity Token. We recommend that you avoid using any
+// of the provided web identity token. We recommend that you avoid using any
 // personally identifiable information (PII) in this field. For example, you
 // could instead use a GUID or a pairwise identifier, as suggested in the OIDC
 // specification (http://openid.net/specs/openid-connect-core-1_0.html#SubjectIDTypes).
@@ -1108,6 +1089,70 @@ func (c *STS) GetFederationTokenRequest(input *GetFederationTokenInput) (req *re
 // You must pass an inline or managed session policy (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
 // to this operation. You can pass a single JSON policy document to use as an
 // inline session policy. You can also specify up to 10 managed policies to
+// use as managed session policies. The plaintext that you use for both inline
+// and managed session policies can't exceed 2,048 characters.
+//
+// Though the session policy parameters are optional, if you do not pass a policy,
+// then the resulting federated user session has no permissions. When you pass
+// session policies, the session permissions are the intersection of the IAM
+// user policies and the session policies that you pass. This gives you a way
+// to further restrict the permissions for a federated user. You cannot use
+// session policies to grant more permissions than those that are defined in
+// the permissions policy of the IAM user. For more information, see Session
+// Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
+// in the IAM User Guide. For information about using GetFederationToken to
+// create temporary security credentials, see GetFederationToken—Federation
+// Through a Custom Identity Broker (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_getfederationtoken).
+//
+// You can use the credentials to access a resource that has a resource-based
+// policy. If that policy specifically references the federated user session
+// in the Principal element of the policy, the session has the permissions allowed
+// by the policy. These permissions are granted in addition to the permissions
+// granted by the session policies.
+//
+// Tags
+//
+// (Optional) You can pass tag key-value pairs to your session. These are called
+// session tags. For more information about session tags, see Passing Session
+// Tags in STS (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html)
+// in the IAM User Guide.
+//
+// You can create a mobile-based or browser-based app that can authenticate
+// users using a web identity provider like Login with Amazon, Facebook, Google,
+// or an OpenID Connect-compatible identity provider. In this case, we recommend
+// that you use Amazon Cognito (http://aws.amazon.com/cognito/) or AssumeRoleWithWebIdentity.
+// For more information, see Federation Through a Web-based Identity Provider
+// (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_assumerolewithwebidentity)
+// in the IAM User Guide.
+//
+// You can also call GetFederationToken using the security credentials of an
+// AWS account root user, but we do not recommend it. Instead, we recommend
+// that you create an IAM user for the purpose of the proxy application. Then
+// attach a policy to the IAM user that limits federated users to only the actions
+// and resources that they need to access. For more information, see IAM Best
+// Practices (https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html)
+// in the IAM User Guide.
+//
+// Session duration
+//
+// The temporary credentials are valid for the specified duration, from 900
+// seconds (15 minutes) up to a maximum of 129,600 seconds (36 hours). The default
+// session duration is 43,200 seconds (12 hours). Temporary credentials that
+// are obtained by using AWS account root user credentials have a maximum duration
+// of 3,600 seconds (1 hour).
+//
+// Permissions
+//
+// You can use the temporary credentials created by GetFederationToken in any
+// AWS service except the following:
+//
+//    * You cannot call any IAM operations using the AWS CLI or the AWS API.
+//
+//    * You cannot call any STS operations except GetCallerIdentity.
+//
+// You must pass an inline or managed session policy (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
+// to this operation. You can pass a single JSON policy document to use as an
+// inline session policy. You can also specify up to 10 managed policies to
 // use as managed session policies. The plain text that you use for both inline
 // and managed session policies can't exceed 2,048 characters.
 //
@@ -1338,14 +1383,15 @@ func (c *STS) GetSessionTokenWithContext(ctx aws.Context, input *GetSessionToken
 type AssumeRoleInput struct {
 	_ struct{} `type:"structure"`
 
-	// The duration, in seconds, of the role session. The value can range from 900
-	// seconds (15 minutes) up to the maximum session duration setting for the role.
-	// This setting can have a value from 1 hour to 12 hours. If you specify a value
-	// higher than this setting, the operation fails. For example, if you specify
-	// a session duration of 12 hours, but your administrator set the maximum session
-	// duration to 6 hours, your operation fails. To learn how to view the maximum
-	// value for your role, see View the Maximum Session Duration Setting for a
-	// Role (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html#id_roles_use_view-role-max-session)
+	// The duration, in seconds, of the role session. The value specified can can
+	// range from 900 seconds (15 minutes) up to the maximum session duration that
+	// is set for the role. The maximum session duration setting can have a value
+	// from 1 hour to 12 hours. If you specify a value higher than this setting
+	// or the administrator setting (whichever is lower), the operation fails. For
+	// example, if you specify a session duration of 12 hours, but your administrator
+	// set the maximum session duration to 6 hours, your operation fails. To learn
+	// how to view the maximum value for your role, see View the Maximum Session
+	// Duration Setting for a Role (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html#id_roles_use_view-role-max-session)
 	// in the IAM User Guide.
 	//
 	// By default, the value is set to 3600 seconds.
@@ -1387,17 +1433,17 @@ type AssumeRoleInput struct {
 	// that is being assumed. For more information, see Session Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
 	// in the IAM User Guide.
 	//
-	// The plain text that you use for both inline and managed session policies
-	// can't exceed 2,048 characters. The JSON policy characters can be any ASCII
-	// character from the space character to the end of the valid character list
-	// (\u0020 through \u00FF). It can also include the tab (\u0009), linefeed (\u000A),
-	// and carriage return (\u000D) characters.
+	// The plaintext that you use for both inline and managed session policies can't
+	// exceed 2,048 characters. The JSON policy characters can be any ASCII character
+	// from the space character to the end of the valid character list (\u0020 through
+	// \u00FF). It can also include the tab (\u0009), linefeed (\u000A), and carriage
+	// return (\u000D) characters.
 	//
 	// An AWS conversion compresses the passed session policies and session tags
 	// into a packed binary format that has a separate limit. Your request can fail
-	// for this limit even if your plain text meets the other requirements. The
-	// PackedPolicySize response element indicates by percentage how close the policies
-	// and tags for your request are to the upper size limit.
+	// for this limit even if your plaintext meets the other requirements. The PackedPolicySize
+	// response element indicates by percentage how close the policies and tags
+	// for your request are to the upper size limit.
 	Policy *string `min:"1" type:"string"`
 
 	// The Amazon Resource Names (ARNs) of the IAM managed policies that you want
@@ -1405,16 +1451,16 @@ type AssumeRoleInput struct {
 	// as the role.
 	//
 	// This parameter is optional. You can provide up to 10 managed policy ARNs.
-	// However, the plain text that you use for both inline and managed session
-	// policies can't exceed 2,048 characters. For more information about ARNs,
-	// see Amazon Resource Names (ARNs) and AWS Service Namespaces (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html)
+	// However, the plaintext that you use for both inline and managed session policies
+	// can't exceed 2,048 characters. For more information about ARNs, see Amazon
+	// Resource Names (ARNs) and AWS Service Namespaces (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html)
 	// in the AWS General Reference.
 	//
 	// An AWS conversion compresses the passed session policies and session tags
 	// into a packed binary format that has a separate limit. Your request can fail
-	// for this limit even if your plain text meets the other requirements. The
-	// PackedPolicySize response element indicates by percentage how close the policies
-	// and tags for your request are to the upper size limit.
+	// for this limit even if your plaintext meets the other requirements. The PackedPolicySize
+	// response element indicates by percentage how close the policies and tags
+	// for your request are to the upper size limit.
 	//
 	// Passing policies to this operation returns new temporary credentials. The
 	// resulting session's permissions are the intersection of the role's identity-based
@@ -1459,22 +1505,41 @@ type AssumeRoleInput struct {
 	// also include underscores or any of the following characters: =,.@-
 	SerialNumber *string `min:"9" type:"string"`
 
+	// The source identity specified by the principal that is calling the AssumeRole
+	// operation.
+	//
+	// You can require users to specify a source identity when they assume a role.
+	// You do this by using the sts:SourceIdentity condition key in a role trust
+	// policy. You can use source identity information in AWS CloudTrail logs to
+	// determine who took actions with a role. You can use the aws:SourceIdentity
+	// condition key to further control access to AWS resources based on the value
+	// of source identity. For more information about using source identity, see
+	// Monitor and control actions taken with assumed roles (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_monitor.html)
+	// in the IAM User Guide.
+	//
+	// The regex used to validate this parameter is a string of characters consisting
+	// of upper- and lower-case alphanumeric characters with no spaces. You can
+	// also include underscores or any of the following characters: =,.@-. You cannot
+	// use a value that begins with the text aws:. This prefix is reserved for AWS
+	// internal use.
+	SourceIdentity *string `min:"2" type:"string"`
+
 	// A list of session tags that you want to pass. Each session tag consists of
 	// a key name and an associated value. For more information about session tags,
 	// see Tagging AWS STS Sessions (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html)
 	// in the IAM User Guide.
 	//
-	// This parameter is optional. You can pass up to 50 session tags. The plain
-	// text session tag keys can’t exceed 128 characters, and the values can’t
-	// exceed 256 characters. For these and additional limits, see IAM and STS Character
+	// This parameter is optional. You can pass up to 50 session tags. The plaintext
+	// session tag keys can’t exceed 128 characters, and the values can’t exceed
+	// 256 characters. For these and additional limits, see IAM and STS Character
 	// Limits (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length)
 	// in the IAM User Guide.
 	//
 	// An AWS conversion compresses the passed session policies and session tags
 	// into a packed binary format that has a separate limit. Your request can fail
-	// for this limit even if your plain text meets the other requirements. The
-	// PackedPolicySize response element indicates by percentage how close the policies
-	// and tags for your request are to the upper size limit.
+	// for this limit even if your plaintext meets the other requirements. The PackedPolicySize
+	// response element indicates by percentage how close the policies and tags
+	// for your request are to the upper size limit.
 	//
 	// You can pass a session tag with the same key as a tag that is already attached
 	// to the role. When you do, session tags override a role tag with the same
@@ -1495,9 +1560,10 @@ type AssumeRoleInput struct {
 	Tags []*Tag `type:"list"`
 
 	// The value provided by the MFA device, if the trust policy of the role being
-	// assumed requires MFA (that is, if the policy includes a condition that tests
-	// for MFA). If the role being assumed requires MFA and if the TokenCode value
-	// is missing or expired, the AssumeRole call returns an "access denied" error.
+	// assumed requires MFA. (In other words, if the policy includes a condition
+	// that tests for MFA). If the role being assumed requires MFA and if the TokenCode
+	// value is missing or expired, the AssumeRole call returns an "access denied"
+	// error.
 	//
 	// The format for this parameter, as described by its regex pattern, is a sequence
 	// of six numeric digits.
@@ -1554,6 +1620,9 @@ func (s *AssumeRoleInput) Validate() error {
 	if s.SerialNumber != nil && len(*s.SerialNumber) < 9 {
 		invalidParams.Add(request.NewErrParamMinLen("SerialNumber", 9))
 	}
+	if s.SourceIdentity != nil && len(*s.SourceIdentity) < 2 {
+		invalidParams.Add(request.NewErrParamMinLen("SourceIdentity", 2))
+	}
 	if s.TokenCode != nil && len(*s.TokenCode) < 6 {
 		invalidParams.Add(request.NewErrParamMinLen("TokenCode", 6))
 	}
@@ -1626,6 +1695,12 @@ func (s *AssumeRoleInput) SetSerialNumber(v string) *AssumeRoleInput {
 	return s
 }
 
+// SetSourceIdentity sets the SourceIdentity field's value.
+func (s *AssumeRoleInput) SetSourceIdentity(v string) *AssumeRoleInput {
+	s.SourceIdentity = &v
+	return s
+}
+
 // SetTags sets the Tags field's value.
 func (s *AssumeRoleInput) SetTags(v []*Tag) *AssumeRoleInput {
 	s.Tags = v
@@ -1668,6 +1743,23 @@ type AssumeRoleOutput struct {
 	// packed size is greater than 100 percent, which means the policies and tags
 	// exceeded the allowed space.
 	PackedPolicySize *int64 `type:"integer"`
+
+	// The source identity specified by the principal that is calling the AssumeRole
+	// operation.
+	//
+	// You can require users to specify a source identity when they assume a role.
+	// You do this by using the sts:SourceIdentity condition key in a role trust
+	// policy. You can use source identity information in AWS CloudTrail logs to
+	// determine who took actions with a role. You can use the aws:SourceIdentity
+	// condition key to further control access to AWS resources based on the value
+	// of source identity. For more information about using source identity, see
+	// Monitor and control actions taken with assumed roles (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_monitor.html)
+	// in the IAM User Guide.
+	//
+	// The regex used to validate this parameter is a string of characters consisting
+	// of upper- and lower-case alphanumeric characters with no spaces. You can
+	// also include underscores or any of the following characters: =,.@-
+	SourceIdentity *string `min:"2" type:"string"`
 }
 
 // String returns the string representation
@@ -1698,6 +1790,12 @@ func (s *AssumeRoleOutput) SetPackedPolicySize(v int64) *AssumeRoleOutput {
 	return s
 }
 
+// SetSourceIdentity sets the SourceIdentity field's value.
+func (s *AssumeRoleOutput) SetSourceIdentity(v string) *AssumeRoleOutput {
+	s.SourceIdentity = &v
+	return s
+}
+
 type AssumeRoleWithSAMLInput struct {
 	_ struct{} `type:"structure"`
 
@@ -1736,17 +1834,17 @@ type AssumeRoleWithSAMLInput struct {
 	// that is being assumed. For more information, see Session Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
 	// in the IAM User Guide.
 	//
-	// The plain text that you use for both inline and managed session policies
-	// can't exceed 2,048 characters. The JSON policy characters can be any ASCII
-	// character from the space character to the end of the valid character list
-	// (\u0020 through \u00FF). It can also include the tab (\u0009), linefeed (\u000A),
-	// and carriage return (\u000D) characters.
+	// The plaintext that you use for both inline and managed session policies can't
+	// exceed 2,048 characters. The JSON policy characters can be any ASCII character
+	// from the space character to the end of the valid character list (\u0020 through
+	// \u00FF). It can also include the tab (\u0009), linefeed (\u000A), and carriage
+	// return (\u000D) characters.
 	//
 	// An AWS conversion compresses the passed session policies and session tags
 	// into a packed binary format that has a separate limit. Your request can fail
-	// for this limit even if your plain text meets the other requirements. The
-	// PackedPolicySize response element indicates by percentage how close the policies
-	// and tags for your request are to the upper size limit.
+	// for this limit even if your plaintext meets the other requirements. The PackedPolicySize
+	// response element indicates by percentage how close the policies and tags
+	// for your request are to the upper size limit.
 	Policy *string `min:"1" type:"string"`
 
 	// The Amazon Resource Names (ARNs) of the IAM managed policies that you want
@@ -1754,16 +1852,16 @@ type AssumeRoleWithSAMLInput struct {
 	// as the role.
 	//
 	// This parameter is optional. You can provide up to 10 managed policy ARNs.
-	// However, the plain text that you use for both inline and managed session
-	// policies can't exceed 2,048 characters. For more information about ARNs,
-	// see Amazon Resource Names (ARNs) and AWS Service Namespaces (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html)
+	// However, the plaintext that you use for both inline and managed session policies
+	// can't exceed 2,048 characters. For more information about ARNs, see Amazon
+	// Resource Names (ARNs) and AWS Service Namespaces (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html)
 	// in the AWS General Reference.
 	//
 	// An AWS conversion compresses the passed session policies and session tags
 	// into a packed binary format that has a separate limit. Your request can fail
-	// for this limit even if your plain text meets the other requirements. The
-	// PackedPolicySize response element indicates by percentage how close the policies
-	// and tags for your request are to the upper size limit.
+	// for this limit even if your plaintext meets the other requirements. The PackedPolicySize
+	// response element indicates by percentage how close the policies and tags
+	// for your request are to the upper size limit.
 	//
 	// Passing policies to this operation returns new temporary credentials. The
 	// resulting session's permissions are the intersection of the role's identity-based
@@ -1786,7 +1884,7 @@ type AssumeRoleWithSAMLInput struct {
 	// RoleArn is a required field
 	RoleArn *string `min:"20" type:"string" required:"true"`
 
-	// The base-64 encoded SAML authentication response provided by the IdP.
+	// The base64 encoded SAML authentication response provided by the IdP.
 	//
 	// For more information, see Configuring a Relying Party and Adding Claims (https://docs.aws.amazon.com/IAM/latest/UserGuide/create-role-saml-IdP-tasks.html)
 	// in the IAM User Guide.
@@ -1908,10 +2006,17 @@ type AssumeRoleWithSAMLOutput struct {
 	// The value of the Issuer element of the SAML assertion.
 	Issuer *string `type:"string"`
 
-	// A hash value based on the concatenation of the Issuer response value, the
-	// AWS account ID, and the friendly name (the last part of the ARN) of the SAML
-	// provider in IAM. The combination of NameQualifier and Subject can be used
-	// to uniquely identify a federated user.
+	// A hash value based on the concatenation of the following:
+	//
+	//    * The Issuer response value.
+	//
+	//    * The AWS account ID.
+	//
+	//    * The friendly name (the last part of the ARN) of the SAML provider in
+	//    IAM.
+	//
+	// The combination of NameQualifier and Subject can be used to uniquely identify
+	// a federated user.
 	//
 	// The following pseudocode shows how the hash value is calculated:
 	//
@@ -1925,6 +2030,26 @@ type AssumeRoleWithSAMLOutput struct {
 	// exceeded the allowed space.
 	PackedPolicySize *int64 `type:"integer"`
 
+	// The value in the SourceIdentity attribute in the SAML assertion.
+	//
+	// You can require users to set a source identity value when they assume a role.
+	// You do this by using the sts:SourceIdentity condition key in a role trust
+	// policy. That way, actions that are taken with the role are associated with
+	// that user. After the source identity is set, the value cannot be changed.
+	// It is present in the request for all actions that are taken by the role and
+	// persists across chained role (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts#iam-term-role-chaining)
+	// sessions. You can configure your SAML identity provider to use an attribute
+	// associated with your users, like user name or email, as the source identity
+	// when calling AssumeRoleWithSAML. You do this by adding an attribute to the
+	// SAML assertion. For more information about using source identity, see Monitor
+	// and control actions taken with assumed roles (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_monitor.html)
+	// in the IAM User Guide.
+	//
+	// The regex used to validate this parameter is a string of characters consisting
+	// of upper- and lower-case alphanumeric characters with no spaces. You can
+	// also include underscores or any of the following characters: =,.@-
+	SourceIdentity *string `min:"2" type:"string"`
+
 	// The value of the NameID element in the Subject element of the SAML assertion.
 	Subject *string `type:"string"`
 
@@ -1985,6 +2110,12 @@ func (s *AssumeRoleWithSAMLOutput) SetPackedPolicySize(v int64) *AssumeRoleWithS
 	return s
 }
 
+// SetSourceIdentity sets the SourceIdentity field's value.
+func (s *AssumeRoleWithSAMLOutput) SetSourceIdentity(v string) *AssumeRoleWithSAMLOutput {
+	s.SourceIdentity = &v
+	return s
+}
+
 // SetSubject sets the Subject field's value.
 func (s *AssumeRoleWithSAMLOutput) SetSubject(v string) *AssumeRoleWithSAMLOutput {
 	s.Subject = &v
@@ -2032,17 +2163,17 @@ type AssumeRoleWithWebIdentityInput struct {
 	// that is being assumed. For more information, see Session Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
 	// in the IAM User Guide.
 	//
-	// The plain text that you use for both inline and managed session policies
-	// can't exceed 2,048 characters. The JSON policy characters can be any ASCII
-	// character from the space character to the end of the valid character list
-	// (\u0020 through \u00FF). It can also include the tab (\u0009), linefeed (\u000A),
-	// and carriage return (\u000D) characters.
+	// The plaintext that you use for both inline and managed session policies can't
+	// exceed 2,048 characters. The JSON policy characters can be any ASCII character
+	// from the space character to the end of the valid character list (\u0020 through
+	// \u00FF). It can also include the tab (\u0009), linefeed (\u000A), and carriage
+	// return (\u000D) characters.
 	//
 	// An AWS conversion compresses the passed session policies and session tags
 	// into a packed binary format that has a separate limit. Your request can fail
-	// for this limit even if your plain text meets the other requirements. The
-	// PackedPolicySize response element indicates by percentage how close the policies
-	// and tags for your request are to the upper size limit.
+	// for this limit even if your plaintext meets the other requirements. The PackedPolicySize
+	// response element indicates by percentage how close the policies and tags
+	// for your request are to the upper size limit.
 	Policy *string `min:"1" type:"string"`
 
 	// The Amazon Resource Names (ARNs) of the IAM managed policies that you want
@@ -2050,16 +2181,16 @@ type AssumeRoleWithWebIdentityInput struct {
 	// as the role.
 	//
 	// This parameter is optional. You can provide up to 10 managed policy ARNs.
-	// However, the plain text that you use for both inline and managed session
-	// policies can't exceed 2,048 characters. For more information about ARNs,
-	// see Amazon Resource Names (ARNs) and AWS Service Namespaces (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html)
+	// However, the plaintext that you use for both inline and managed session policies
+	// can't exceed 2,048 characters. For more information about ARNs, see Amazon
+	// Resource Names (ARNs) and AWS Service Namespaces (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html)
 	// in the AWS General Reference.
 	//
 	// An AWS conversion compresses the passed session policies and session tags
 	// into a packed binary format that has a separate limit. Your request can fail
-	// for this limit even if your plain text meets the other requirements. The
-	// PackedPolicySize response element indicates by percentage how close the policies
-	// and tags for your request are to the upper size limit.
+	// for this limit even if your plaintext meets the other requirements. The PackedPolicySize
+	// response element indicates by percentage how close the policies and tags
+	// for your request are to the upper size limit.
 	//
 	// Passing policies to this operation returns new temporary credentials. The
 	// resulting session's permissions are the intersection of the role's identity-based
@@ -2242,6 +2373,29 @@ type AssumeRoleWithWebIdentityOutput struct {
 	// in the AssumeRoleWithWebIdentity request.
 	Provider *string `type:"string"`
 
+	// The value of the source identity that is returned in the JSON web token (JWT)
+	// from the identity provider.
+	//
+	// You can require users to set a source identity value when they assume a role.
+	// You do this by using the sts:SourceIdentity condition key in a role trust
+	// policy. That way, actions that are taken with the role are associated with
+	// that user. After the source identity is set, the value cannot be changed.
+	// It is present in the request for all actions that are taken by the role and
+	// persists across chained role (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts#iam-term-role-chaining)
+	// sessions. You can configure your identity provider to use an attribute associated
+	// with your users, like user name or email, as the source identity when calling
+	// AssumeRoleWithWebIdentity. You do this by adding a claim to the JSON web
+	// token. To learn more about OIDC tokens and claims, see Using Tokens with
+	// User Pools (https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-tokens-with-identity-providers.html)
+	// in the Amazon Cognito Developer Guide. For more information about using source
+	// identity, see Monitor and control actions taken with assumed roles (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_monitor.html)
+	// in the IAM User Guide.
+	//
+	// The regex used to validate this parameter is a string of characters consisting
+	// of upper- and lower-case alphanumeric characters with no spaces. You can
+	// also include underscores or any of the following characters: =,.@-
+	SourceIdentity *string `min:"2" type:"string"`
+
 	// The unique user identifier that is returned by the identity provider. This
 	// identifier is associated with the WebIdentityToken that was submitted with
 	// the AssumeRoleWithWebIdentity call. The identifier is typically unique to
@@ -2291,6 +2445,12 @@ func (s *AssumeRoleWithWebIdentityOutput) SetProvider(v string) *AssumeRoleWithW
 	return s
 }
 
+// SetSourceIdentity sets the SourceIdentity field's value.
+func (s *AssumeRoleWithWebIdentityOutput) SetSourceIdentity(v string) *AssumeRoleWithWebIdentityOutput {
+	s.SourceIdentity = &v
+	return s
+}
+
 // SetSubjectFromWebIdentityToken sets the SubjectFromWebIdentityToken field's value.
 func (s *AssumeRoleWithWebIdentityOutput) SetSubjectFromWebIdentityToken(v string) *AssumeRoleWithWebIdentityOutput {
 	s.SubjectFromWebIdentityToken = &v
@@ -2682,17 +2842,17 @@ type GetFederationTokenInput struct {
 	// by the policy. These permissions are granted in addition to the permissions
 	// that are granted by the session policies.
 	//
-	// The plain text that you use for both inline and managed session policies
-	// can't exceed 2,048 characters. The JSON policy characters can be any ASCII
-	// character from the space character to the end of the valid character list
-	// (\u0020 through \u00FF). It can also include the tab (\u0009), linefeed (\u000A),
-	// and carriage return (\u000D) characters.
+	// The plaintext that you use for both inline and managed session policies can't
+	// exceed 2,048 characters. The JSON policy characters can be any ASCII character
+	// from the space character to the end of the valid character list (\u0020 through
+	// \u00FF). It can also include the tab (\u0009), linefeed (\u000A), and carriage
+	// return (\u000D) characters.
 	//
 	// An AWS conversion compresses the passed session policies and session tags
 	// into a packed binary format that has a separate limit. Your request can fail
-	// for this limit even if your plain text meets the other requirements. The
-	// PackedPolicySize response element indicates by percentage how close the policies
-	// and tags for your request are to the upper size limit.
+	// for this limit even if your plaintext meets the other requirements. The PackedPolicySize
+	// response element indicates by percentage how close the policies and tags
+	// for your request are to the upper size limit.
 	Policy *string `min:"1" type:"string"`
 
 	// The Amazon Resource Names (ARNs) of the IAM managed policies that you want
@@ -2702,7 +2862,7 @@ type GetFederationTokenInput struct {
 	// You must pass an inline or managed session policy (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
 	// to this operation. You can pass a single JSON policy document to use as an
 	// inline session policy. You can also specify up to 10 managed policies to
-	// use as managed session policies. The plain text that you use for both inline
+	// use as managed session policies. The plaintext that you use for both inline
 	// and managed session policies can't exceed 2,048 characters. You can provide
 	// up to 10 managed policy ARNs. For more information about ARNs, see Amazon
 	// Resource Names (ARNs) and AWS Service Namespaces (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html)
@@ -2727,9 +2887,9 @@ type GetFederationTokenInput struct {
 	//
 	// An AWS conversion compresses the passed session policies and session tags
 	// into a packed binary format that has a separate limit. Your request can fail
-	// for this limit even if your plain text meets the other requirements. The
-	// PackedPolicySize response element indicates by percentage how close the policies
-	// and tags for your request are to the upper size limit.
+	// for this limit even if your plaintext meets the other requirements. The PackedPolicySize
+	// response element indicates by percentage how close the policies and tags
+	// for your request are to the upper size limit.
 	PolicyArns []*PolicyDescriptorType `type:"list"`
 
 	// A list of session tags. Each session tag consists of a key name and an associated
@@ -2737,17 +2897,17 @@ type GetFederationTokenInput struct {
 	// in STS (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html)
 	// in the IAM User Guide.
 	//
-	// This parameter is optional. You can pass up to 50 session tags. The plain
-	// text session tag keys can’t exceed 128 characters and the values can’t
-	// exceed 256 characters. For these and additional limits, see IAM and STS Character
+	// This parameter is optional. You can pass up to 50 session tags. The plaintext
+	// session tag keys can’t exceed 128 characters and the values can’t exceed
+	// 256 characters. For these and additional limits, see IAM and STS Character
 	// Limits (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length)
 	// in the IAM User Guide.
 	//
 	// An AWS conversion compresses the passed session policies and session tags
 	// into a packed binary format that has a separate limit. Your request can fail
-	// for this limit even if your plain text meets the other requirements. The
-	// PackedPolicySize response element indicates by percentage how close the policies
-	// and tags for your request are to the upper size limit.
+	// for this limit even if your plaintext meets the other requirements. The PackedPolicySize
+	// response element indicates by percentage how close the policies and tags
+	// for your request are to the upper size limit.
 	//
 	// You can pass a session tag with the same key as a tag that is already attached
 	// to the user you are federating. When you do, session tags override a user

vendor/github.com/aws/aws-sdk-go/service/wafv2/doc.go

@@ -4,65 +4,63 @@
 // requests to AWS WAFV2.
 //
 //
-// This is the latest version of the AWS WAF API, released in November, 2019.
-// The names of the entities that you use to access this API, like endpoints
-// and namespaces, all have the versioning information added, like "V2" or "v2",
+// This is the latest version of the WAF API, released in November, 2019. The
+// names of the entities that you use to access this API, like endpoints and
+// namespaces, all have the versioning information added, like "V2" or "v2",
 // to distinguish from the prior version. We recommend migrating your resources
 // to this version, because it has a number of significant improvements.
 //
-// If you used AWS WAF prior to this release, you can't use this AWS WAFV2 API
-// to access any AWS WAF resources that you created before. You can access your
-// old rules, web ACLs, and other AWS WAF resources only through the AWS WAF
-// Classic APIs. The AWS WAF Classic APIs have retained the prior names, endpoints,
-// and namespaces.
+// If you used WAF prior to this release, you can't use this WAFV2 API to access
+// any WAF resources that you created before. You can access your old rules,
+// web ACLs, and other WAF resources only through the WAF Classic APIs. The
+// WAF Classic APIs have retained the prior names, endpoints, and namespaces.
 //
-// For information, including how to migrate your AWS WAF resources to this
-// version, see the AWS WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html).
+// For information, including how to migrate your WAF resources to this version,
+// see the WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html).
 //
-// AWS WAF is a web application firewall that lets you monitor the HTTP and
-// HTTPS requests that are forwarded to Amazon CloudFront, an Amazon API Gateway
-// REST API, an Application Load Balancer, or an AWS AppSync GraphQL API. AWS
-// WAF also lets you control access to your content. Based on conditions that
-// you specify, such as the IP addresses that requests originate from or the
-// values of query strings, the API Gateway REST API, CloudFront distribution,
-// the Application Load Balancer, or the AWS AppSync GraphQL API responds to
-// requests either with the requested content or with an HTTP 403 status code
-// (Forbidden). You also can configure CloudFront to return a custom error page
-// when a request is blocked.
+// WAF is a web application firewall that lets you monitor the HTTP and HTTPS
+// requests that are forwarded to Amazon CloudFront, an Amazon API Gateway REST
+// API, an Application Load Balancer, or an AppSync GraphQL API. WAF also lets
+// you control access to your content. Based on conditions that you specify,
+// such as the IP addresses that requests originate from or the values of query
+// strings, the Amazon API Gateway REST API, CloudFront distribution, the Application
+// Load Balancer, or the AppSync GraphQL API responds to requests either with
+// the requested content or with an HTTP 403 status code (Forbidden). You also
+// can configure CloudFront to return a custom error page when a request is
+// blocked.
 //
-// This API guide is for developers who need detailed information about AWS
-// WAF API actions, data types, and errors. For detailed information about AWS
-// WAF features and an overview of how to use AWS WAF, see the AWS WAF Developer
-// Guide (https://docs.aws.amazon.com/waf/latest/developerguide/).
+// This API guide is for developers who need detailed information about WAF
+// API actions, data types, and errors. For detailed information about WAF features
+// and an overview of how to use WAF, see the WAF Developer Guide (https://docs.aws.amazon.com/waf/latest/developerguide/).
 //
-// You can make calls using the endpoints listed in AWS Service Endpoints for
-// AWS WAF (https://docs.aws.amazon.com/general/latest/gr/rande.html#waf_region).
+// You can make calls using the endpoints listed in Amazon Web Services Service
+// Endpoints for WAF (https://docs.aws.amazon.com/general/latest/gr/rande.html#waf_region).
 //
 //    * For regional applications, you can use any of the endpoints in the list.
-//    A regional application can be an Application Load Balancer (ALB), an API
-//    Gateway REST API, or an AppSync GraphQL API.
+//    A regional application can be an Application Load Balancer (ALB), an Amazon
+//    API Gateway REST API, or an AppSync GraphQL API.
 //
-//    * For AWS CloudFront applications, you must use the API endpoint listed
+//    * For Amazon CloudFront applications, you must use the API endpoint listed
 //    for US East (N. Virginia): us-east-1.
 //
-// Alternatively, you can use one of the AWS SDKs to access an API that's tailored
-// to the programming language or platform that you're using. For more information,
-// see AWS SDKs (http://aws.amazon.com/tools/#SDKs).
+// Alternatively, you can use one of the Amazon Web Services SDKs to access
+// an API that's tailored to the programming language or platform that you're
+// using. For more information, see Amazon Web Services SDKs (http://aws.amazon.com/tools/#SDKs).
 //
-// We currently provide two versions of the AWS WAF API: this API and the prior
-// versions, the classic AWS WAF APIs. This new API provides the same functionality
+// We currently provide two versions of the WAF API: this API and the prior
+// versions, the classic WAF APIs. This new API provides the same functionality
 // as the older versions, with the following major improvements:
 //
 //    * You use one API for both global and regional applications. Where you
 //    need to distinguish the scope, you specify a Scope parameter and set it
 //    to CLOUDFRONT or REGIONAL.
 //
-//    * You can define a Web ACL or rule group with a single call, and update
+//    * You can define a web ACL or rule group with a single call, and update
 //    it with a single call. You define all rule specifications in JSON format,
-//    and pass them to your rule group or Web ACL calls.
+//    and pass them to your rule group or web ACL calls.
 //
-//    * The limits AWS WAF places on the use of rules more closely reflects
-//    the cost of running each type of rule. Rule groups include capacity settings,
+//    * The limits WAF places on the use of rules more closely reflects the
+//    cost of running each type of rule. Rule groups include capacity settings,
 //    so you know the maximum cost of a rule group when you use it.
 //
 // See https://docs.aws.amazon.com/goto/WebAPI/wafv2-2019-07-29 for more information on this service.

vendor/github.com/aws/aws-sdk-go/service/wafv2/errors.go

@@ -11,22 +11,22 @@ const (
 	// ErrCodeWAFAssociatedItemException for service response error code
 	// "WAFAssociatedItemException".
 	//
-	// AWS WAF couldn’t perform the operation because your resource is being used
+	// WAF couldn’t perform the operation because your resource is being used
 	// by another resource or it’s associated with another resource.
 	ErrCodeWAFAssociatedItemException = "WAFAssociatedItemException"
 
 	// ErrCodeWAFDuplicateItemException for service response error code
 	// "WAFDuplicateItemException".
 	//
-	// AWS WAF couldn’t perform the operation because the resource that you tried
+	// WAF couldn’t perform the operation because the resource that you tried
 	// to save is a duplicate of an existing one.
 	ErrCodeWAFDuplicateItemException = "WAFDuplicateItemException"
 
 	// ErrCodeWAFInternalErrorException for service response error code
 	// "WAFInternalErrorException".
 	//
-	// Your request is valid, but AWS WAF couldn’t perform the operation because
-	// of a system problem. Retry your request.
+	// Your request is valid, but WAF couldn’t perform the operation because of
+	// a system problem. Retry your request.
 	ErrCodeWAFInternalErrorException = "WAFInternalErrorException"
 
 	// ErrCodeWAFInvalidOperationException for service response error code
@@ -38,10 +38,10 @@ const (
 	// ErrCodeWAFInvalidParameterException for service response error code
 	// "WAFInvalidParameterException".
 	//
-	// The operation failed because AWS WAF didn't recognize a parameter in the
-	// request. For example:
+	// The operation failed because WAF didn't recognize a parameter in the request.
+	// For example:
 	//
-	//    * You specified an invalid parameter name or value.
+	//    * You specified a parameter name or value that isn't valid.
 	//
 	//    * Your nested statement isn't valid. You might have tried to nest a statement
 	//    that can’t be nested.
@@ -50,7 +50,7 @@ const (
 	//    types available at DefaultAction.
 	//
 	//    * Your request references an ARN that is malformed, or corresponds to
-	//    a resource with which a Web ACL cannot be associated.
+	//    a resource with which a web ACL can't be associated.
 	ErrCodeWAFInvalidParameterException = "WAFInvalidParameterException"
 
 	// ErrCodeWAFInvalidPermissionPolicyException for service response error code
@@ -68,7 +68,7 @@ const (
 	//    * Effect must specify Allow.
 	//
 	//    * Action must specify wafv2:CreateWebACL, wafv2:UpdateWebACL, and wafv2:PutFirewallManagerRuleGroups.
-	//    AWS WAF rejects any extra actions or wildcard actions in the policy.
+	//    WAF rejects any extra actions or wildcard actions in the policy.
 	//
 	//    * The policy must not include a Resource parameter.
 	//
@@ -78,50 +78,51 @@ const (
 	// ErrCodeWAFInvalidResourceException for service response error code
 	// "WAFInvalidResourceException".
 	//
-	// AWS WAF couldn’t perform the operation because the resource that you requested
+	// WAF couldn’t perform the operation because the resource that you requested
 	// isn’t valid. Check the resource, and try again.
 	ErrCodeWAFInvalidResourceException = "WAFInvalidResourceException"
 
 	// ErrCodeWAFLimitsExceededException for service response error code
 	// "WAFLimitsExceededException".
 	//
-	// AWS WAF couldn’t perform the operation because you exceeded your resource
-	// limit. For example, the maximum number of WebACL objects that you can create
-	// for an AWS account. For more information, see Limits (https://docs.aws.amazon.com/waf/latest/developerguide/limits.html)
-	// in the AWS WAF Developer Guide.
+	// WAF couldn’t perform the operation because you exceeded your resource limit.
+	// For example, the maximum number of WebACL objects that you can create for
+	// an account. For more information, see Limits (https://docs.aws.amazon.com/waf/latest/developerguide/limits.html)
+	// in the WAF Developer Guide.
 	ErrCodeWAFLimitsExceededException = "WAFLimitsExceededException"
 
 	// ErrCodeWAFNonexistentItemException for service response error code
 	// "WAFNonexistentItemException".
 	//
-	// AWS WAF couldn’t perform the operation because your resource doesn’t
-	// exist.
+	// WAF couldn’t perform the operation because your resource doesn’t exist.
 	ErrCodeWAFNonexistentItemException = "WAFNonexistentItemException"
 
 	// ErrCodeWAFOptimisticLockException for service response error code
 	// "WAFOptimisticLockException".
 	//
-	// AWS WAF couldn’t save your changes because you tried to update or delete
-	// a resource that has changed since you last retrieved it. Get the resource
-	// again, make any changes you need to make to the new copy, and retry your
-	// operation.
+	// WAF couldn’t save your changes because you tried to update or delete a
+	// resource that has changed since you last retrieved it. Get the resource again,
+	// make any changes you need to make to the new copy, and retry your operation.
 	ErrCodeWAFOptimisticLockException = "WAFOptimisticLockException"
 
 	// ErrCodeWAFServiceLinkedRoleErrorException for service response error code
 	// "WAFServiceLinkedRoleErrorException".
 	//
-	// AWS WAF is not able to access the service linked role. This can be caused
-	// by a previous PutLoggingConfiguration request, which can lock the service
-	// linked role for about 20 seconds. Please try your request again. The service
-	// linked role can also be locked by a previous DeleteServiceLinkedRole request,
-	// which can lock the role for 15 minutes or more. If you recently made a call
-	// to DeleteServiceLinkedRole, wait at least 15 minutes and try the request
-	// again. If you receive this same exception again, you will have to wait additional
+	// WAF is not able to access the service linked role. This can be caused by
+	// a previous PutLoggingConfiguration request, which can lock the service linked
+	// role for about 20 seconds. Please try your request again. The service linked
+	// role can also be locked by a previous DeleteServiceLinkedRole request, which
+	// can lock the role for 15 minutes or more. If you recently made a call to
+	// DeleteServiceLinkedRole, wait at least 15 minutes and try the request again.
+	// If you receive this same exception again, you will have to wait additional
 	// time until the role is unlocked.
 	ErrCodeWAFServiceLinkedRoleErrorException = "WAFServiceLinkedRoleErrorException"
 
 	// ErrCodeWAFSubscriptionNotFoundException for service response error code
 	// "WAFSubscriptionNotFoundException".
+	//
+	// You tried to use a managed rule group that's available by subscription, but
+	// you aren't subscribed to it yet.
 	ErrCodeWAFSubscriptionNotFoundException = "WAFSubscriptionNotFoundException"
 
 	// ErrCodeWAFTagOperationException for service response error code
@@ -133,14 +134,14 @@ const (
 	// ErrCodeWAFTagOperationInternalErrorException for service response error code
 	// "WAFTagOperationInternalErrorException".
 	//
-	// AWS WAF couldn’t perform your tagging operation because of an internal
-	// error. Retry your request.
+	// WAF couldn’t perform your tagging operation because of an internal error.
+	// Retry your request.
 	ErrCodeWAFTagOperationInternalErrorException = "WAFTagOperationInternalErrorException"
 
 	// ErrCodeWAFUnavailableEntityException for service response error code
 	// "WAFUnavailableEntityException".
 	//
-	// AWS WAF couldn’t retrieve the resource that you requested. Retry your request.
+	// WAF couldn’t retrieve the resource that you requested. Retry your request.
 	ErrCodeWAFUnavailableEntityException = "WAFUnavailableEntityException"
 )
 

vendor/modules.txt

@@ -126,7 +126,7 @@ github.com/anacrolix/utp
 github.com/aokoli/goutils
 # github.com/apache/thrift v0.12.0
 github.com/apache/thrift/lib/go/thrift
-# github.com/aws/aws-sdk-go v1.36.31
+# github.com/aws/aws-sdk-go v1.39.0
 github.com/aws/aws-sdk-go/aws
 github.com/aws/aws-sdk-go/aws/arn
 github.com/aws/aws-sdk-go/aws/awserr
@@ -138,6 +138,7 @@ github.com/aws/aws-sdk-go/aws/credentials
 github.com/aws/aws-sdk-go/aws/credentials/ec2rolecreds
 github.com/aws/aws-sdk-go/aws/credentials/endpointcreds
 github.com/aws/aws-sdk-go/aws/credentials/processcreds
+github.com/aws/aws-sdk-go/aws/credentials/ssocreds
 github.com/aws/aws-sdk-go/aws/credentials/stscreds
 github.com/aws/aws-sdk-go/aws/csm
 github.com/aws/aws-sdk-go/aws/defaults
@@ -168,6 +169,7 @@ github.com/aws/aws-sdk-go/private/protocol/jsonrpc
 github.com/aws/aws-sdk-go/private/protocol/query
 github.com/aws/aws-sdk-go/private/protocol/query/queryutil
 github.com/aws/aws-sdk-go/private/protocol/rest
+github.com/aws/aws-sdk-go/private/protocol/restjson
 github.com/aws/aws-sdk-go/private/protocol/restxml
 github.com/aws/aws-sdk-go/private/protocol/xml/xmlutil
 github.com/aws/aws-sdk-go/service/acm
@@ -181,6 +183,8 @@ github.com/aws/aws-sdk-go/service/organizations
 github.com/aws/aws-sdk-go/service/resourcegroupstaggingapi
 github.com/aws/aws-sdk-go/service/route53
 github.com/aws/aws-sdk-go/service/s3
+github.com/aws/aws-sdk-go/service/sso
+github.com/aws/aws-sdk-go/service/sso/ssoiface
 github.com/aws/aws-sdk-go/service/sts
 github.com/aws/aws-sdk-go/service/sts/stsiface
 github.com/aws/aws-sdk-go/service/wafv2