├[~] service aws-agentregistry │ └ resources │ └[~] resource AWS::AgentRegistry::Registry │ └ types │ └[~] type CustomJWTAuthorizerConfiguration │ └ properties │ └ DiscoveryUrl: (documentation changed) ├[~] service aws-appfabric │ └ resources │ └[~] resource AWS::AppFabric::AppBundle │ └ - arnTemplate: undefined │ + arnTemplate: arn:${Partition}:appfabric:${Region}:${Account}:appbundle/${AppBundleIdentifier} ├[~] service aws-arcregionswitch │ └ resources │ └[~] resource AWS::ARCRegionSwitch::Plan │ └ - arnTemplate: arn:${Partition}:arc-region-switch::${Account}:plan/${ResourceId} │ + arnTemplate: arn:${Partition}:arc-region-switch:${Region}:${Account}:plan/${ResourceId} ├[~] service aws-backup │ └ resources │ └[~] resource AWS::Backup::BackupAccessPoint │ └ - arnTemplate: undefined │ + arnTemplate: arn:${Partition}:backup:${Region}:${Account}:accesspoint/${AccessPointName} ├[~] service aws-batch │ └ resources │ └[~] resource AWS::Batch::JobDefinition │ └ types │ ├[+] type EksContainerLinuxCapabilities │ │ ├ name: EksContainerLinuxCapabilities │ │ └ properties │ │ ├ Add: Array │ │ └ Drop: Array │ ├[+] type EksPodSecurityContext │ │ ├ name: EksPodSecurityContext │ │ └ properties │ │ ├ RunAsUser: integer │ │ ├ RunAsGroup: integer │ │ ├ RunAsNonRoot: boolean │ │ ├ SeccompProfile: EksSeccompProfile │ │ └ FsGroup: integer │ ├[+] type EksSeccompProfile │ │ ├ name: EksSeccompProfile │ │ └ properties │ │ ├ Type: string (required) │ │ └ LocalhostProfile: string │ ├[~] type PodProperties │ │ └ properties │ │ └[+] SecurityContext: EksPodSecurityContext │ └[~] type SecurityContext │ └ properties │ ├[+] Capabilities: EksContainerLinuxCapabilities │ └[+] SeccompProfile: EksSeccompProfile ├[~] service aws-bedrockagentcore │ └ resources │ ├[~] resource AWS::BedrockAgentCore::PaymentManager │ │ └ types │ │ ├[~] type AuthorizerConfiguration │ │ │ └ properties │ │ │ └ CustomJWTAuthorizer: - CustomJWTAuthorizer (required) │ │ │ + CustomJWTAuthorizerConfiguration ⇐ CustomJWTAuthorizer (required) │ │ ├[+] type AuthorizingClaimMatchValueType │ │ │ ├ name: AuthorizingClaimMatchValueType │ │ │ └ properties │ │ │ ├ ClaimMatchValue: ClaimMatchValueType (required) │ │ │ └ ClaimMatchOperator: string (required) │ │ ├[+] type ClaimMatchValueType │ │ │ ├ name: ClaimMatchValueType │ │ │ └ properties │ │ │ ├ MatchValueString: string │ │ │ └ MatchValueStringList: Array │ │ ├[~] type CustomClaimValidationType │ │ │ └ properties │ │ │ └ AuthorizingClaimMatchValue: - AuthorizingClaimMatchValue (required) │ │ │ + AuthorizingClaimMatchValueType ⇐ AuthorizingClaimMatchValue (required) │ │ └[+] type CustomJWTAuthorizerConfiguration │ │ ├ name: CustomJWTAuthorizerConfiguration │ │ └ properties │ │ ├ DiscoveryUrl: string (required) │ │ ├ AllowedAudience: Array │ │ ├ AllowedClients: Array │ │ ├ AllowedScopes: Array │ │ └ CustomClaims: Array │ └[~] resource AWS::BedrockAgentCore::Runtime │ ├ properties │ │ ├[+] HooksConfiguration: RuntimeHooksConfiguration │ │ └[+] ResourceConfigurations: Array │ └ types │ ├[+] type BuildLifecycleHooks │ │ ├ documentation: Hooks that run while the platform builds a runtime version, before any session exists │ │ │ name: BuildLifecycleHooks │ │ └ properties │ │ └ Warmup: LifecycleHook │ ├[+] type HttpPostLifecycleHookAction │ │ ├ documentation: Sends an HTTP POST to the agent's container. Any 2xx response ends the hook; anything else fails it. The path and port must not be a route the platform already calls on the container, such as the protocol's invocation path or the default health check. │ │ │ name: HttpPostLifecycleHookAction │ │ └ properties │ │ ├ Path: string (required) │ │ └ Port: integer │ ├[+] type LifecycleHook │ │ ├ documentation: A lifecycle hook and the action it runs │ │ │ name: LifecycleHook │ │ └ properties │ │ └ Action: LifecycleHookAction (required) │ ├[+] type LifecycleHookAction │ │ ├ documentation: The action a lifecycle hook runs. HttpPost is the only action. │ │ │ name: LifecycleHookAction │ │ └ properties │ │ └ HttpPost: HttpPostLifecycleHookAction (required) │ ├[+] type ResourceConfiguration │ │ ├ documentation: Resource configuration for an agent runtime │ │ │ name: ResourceConfiguration │ │ └ properties │ │ └ MinimumMemoryInMiB: integer (required) │ └[+] type RuntimeHooksConfiguration │ ├ documentation: Lifecycle hooks that the platform runs at fixed points in the runtime's lifecycle │ │ name: RuntimeHooksConfiguration │ └ properties │ └ Build: BuildLifecycleHooks ├[~] service aws-cleanrooms │ └ resources │ └[~] resource AWS::CleanRooms::AnalysisTemplate │ └ properties │ └ Format: - string (required, immutable) │ + string (required, immutable) ├[~] service aws-cloudtrail │ └ resources │ └[~] resource AWS::CloudTrail::Trail │ └ properties │ └[+] RecursiveLogging: boolean ├[~] service aws-cloudwatch │ └ resources │ ├[~] resource AWS::CloudWatch::AccessGrant │ │ └ - arnTemplate: undefined │ │ + arnTemplate: arn:${Partition}:cloudwatch:${Region}:${Account}:access-grant/${GrantId} │ ├[+] resource AWS::CloudWatch::Alert │ │ ├ name: Alert │ │ │ cloudFormationType: AWS::CloudWatch::Alert │ │ │ documentation: Resource Type definition for AWS::CloudWatch::Alert. An alert runs a SQL or PromQL query in a CloudWatch Omni space on a fixed interval, compares the result against warning and critical thresholds, and sends notifications to Amazon SNS topics or integrations when its state changes. │ │ │ tagInformation: {"tagPropertyName":"Tags","variant":"standard"} │ │ │ primaryIdentifier: ["SpaceId","AlertId"] │ │ ├ properties │ │ │ ├ SpaceId: string (required, immutable) │ │ │ ├ ProfileId: string (required) │ │ │ ├ Name: string (required) │ │ │ ├ Description: string │ │ │ ├ Rule: Rule (required) │ │ │ ├ NotificationsEnabled: boolean │ │ │ ├ NotificationRules: Array │ │ │ └ Tags: Array │ │ ├ attributes │ │ │ ├ AccountId: string │ │ │ ├ CreatedAt: string │ │ │ ├ UpdatedAt: string │ │ │ ├ AlertId: string │ │ │ └ Arn: string │ │ └ types │ │ ├ type Condition │ │ │ ├ documentation: The thresholds that set the alert's state. Specify at least one of WarningThreshold and CriticalThreshold. │ │ │ │ name: Condition │ │ │ └ properties │ │ │ ├ ThresholdMode: string │ │ │ ├ ThresholdField: string │ │ │ ├ Comparator: string │ │ │ ├ WarningThreshold: number │ │ │ └ CriticalThreshold: number │ │ ├ type Evaluation │ │ │ ├ documentation: How often the alert is evaluated, and how long a change must last before the state changes. │ │ │ │ name: Evaluation │ │ │ └ properties │ │ │ ├ IntervalSeconds: integer (required) │ │ │ ├ PendingDurationSeconds: integer │ │ │ └ RecoveryDurationSeconds: integer │ │ ├ type NoData │ │ │ ├ documentation: How the alert behaves when an evaluation returns no data. If omitted, the alert reports NODATA. │ │ │ │ name: NoData │ │ │ └ properties │ │ │ └ TreatAs: string (required) │ │ ├ type NotificationRule │ │ │ ├ documentation: A notification rule: which alert states trigger it, and where the notification is sent. │ │ │ │ name: NotificationRule │ │ │ └ properties │ │ │ ├ Trigger: Trigger (required) │ │ │ └ Target: Target (required) │ │ ├ type Query │ │ │ ├ documentation: The query the alert runs, and the language it is written in. │ │ │ │ name: Query │ │ │ └ properties │ │ │ ├ Language: string (required) │ │ │ └ Expression: string (required) │ │ ├ type Rule │ │ │ ├ documentation: The rule that defines how the alert is evaluated. │ │ │ │ name: Rule │ │ │ └ properties │ │ │ └ TelemetryRule: TelemetryRule (required) │ │ ├ type Target │ │ │ ├ documentation: Where the notification is sent. │ │ │ │ name: Target │ │ │ └ properties │ │ │ ├ Type: string (required) │ │ │ ├ Arn: string (required) │ │ │ └ Metadata: Map │ │ ├ type TelemetryRule │ │ │ ├ documentation: A rule that queries telemetry, evaluates the result against a condition, and sets how missing data is handled. │ │ │ │ name: TelemetryRule │ │ │ └ properties │ │ │ ├ Query: Query (required) │ │ │ ├ Condition: Condition (required) │ │ │ ├ Evaluation: Evaluation (required) │ │ │ └ NoData: NoData │ │ └ type Trigger │ │ ├ documentation: The alert states that trigger the notification rule. │ │ │ name: Trigger │ │ └ properties │ │ └ StateValues: Array> │ ├[~] resource AWS::CloudWatch::Space │ │ ├ - documentation: Resource type definition for AWS::CloudWatch::Space │ │ │ + documentation: Resource Type definition for AWS::CloudWatch::Space. A space is where you work in CloudWatch Omni. It gives you access to telemetry from the account and Region in which the space is hosted, and controls who can see it. │ │ ├ properties │ │ │ ├ AgentCoreEvaluationRoleArn: (documentation changed) │ │ │ ├ DataAccessRoleArn: (documentation changed) │ │ │ ├ DomainId: (documentation changed) │ │ │ └ Name: (documentation changed) │ │ ├ attributes │ │ │ ├ CreatedAt: (documentation changed) │ │ │ ├ OwnerAccountId: (documentation changed) │ │ │ ├ Region: (documentation changed) │ │ │ ├ SpaceId: (documentation changed) │ │ │ └ UpdatedAt: (documentation changed) │ │ └ types │ │ └[~] type EncryptionConfiguration │ │ └ properties │ │ ├ EncryptionStrategy: (documentation changed) │ │ └ KmsKeyArn: (documentation changed) │ └[~] resource AWS::CloudWatch::View │ └ - arnTemplate: arn:${Partition}:cloudwatch:${Region}:${Account}:view/${ViewName} │ + arnTemplate: undefined ├[~] service aws-connect │ └ resources │ └[~] resource AWS::Connect::TaskTemplate │ ├ properties │ │ └[+] ContactHooks: ContactHooks │ └ types │ └[+] type ContactHooks │ ├ documentation: The contact hooks for the task template. │ │ name: ContactHooks │ └ properties │ └ WrapUpFlowArn: string ├[~] service aws-datapipeline │ └ resources │ └[~] resource AWS::DataPipeline::Pipeline │ └ - arnTemplate: arn:${Partition}:datapipeline:${Region}:${Account}:pipeline/${PipelineId} │ + arnTemplate: arn:${Partition}:datapipeline:${Region}:${Account}:pipeline/${PipelineID} ├[~] service aws-devicefarm │ └ resources │ ├[~] resource AWS::DeviceFarm::InstanceProfile │ │ └ - arnTemplate: arn:${Partition}:devicefarm:${Region}:${Account}:instanceprofile:${InstanceProfileId} │ │ + arnTemplate: arn:${Partition}:devicefarm:${Region}:${Account}:instanceprofile:${ResourceId} │ └[~] resource AWS::DeviceFarm::Project │ └ - arnTemplate: arn:${Partition}:devicefarm:${Region}:${Account}:project:${ResourceId} │ + arnTemplate: arn:${Partition}:devicefarm:${Region}:${Account}:project:${ProjectId} ├[~] service aws-devopsagent │ └ resources │ └[~] resource AWS::DevOpsAgent::Association │ ├ properties │ │ └[+] Capabilities: Capabilities │ └ types │ ├[+] type AutomatedTestingCapabilityConfiguration │ │ ├ documentation: Configuration of the code change risk analysis automated testing capability. This capability does not support trigger filter groups. │ │ │ name: AutomatedTestingCapabilityConfiguration │ │ └ properties │ │ └ Enabled: boolean │ ├[+] type Capabilities │ │ ├ documentation: Automated AWS DevOps Agent capabilities for the repository in this association. Code change risk analysis analyzes pull requests and merge requests for deployment risk, and automated testing extends that analysis by running tests against the change. Capabilities are supported for GitHub and GitLab associations. When this property is set, it fully defines both capabilities below: a capability omitted here is removed from the association. Removing this property from a template that previously set it disables both capabilities. Capabilities configured outside CloudFormation are left unchanged only while this property has never been set. On rollback, both capabilities are restored to the previous template's values, not to settings made outside CloudFormation. Other capabilities on the association are not affected. Updates read and rewrite the association's full capability set, so a capability change made outside CloudFormation while a stack update is in progress may be overwritten. │ │ │ name: Capabilities │ │ └ properties │ │ ├ CodeChangeRiskAnalysis: CapabilityConfiguration │ │ └ CodeChangeRiskAnalysisAutomatedTesting: AutomatedTestingCapabilityConfiguration │ ├[+] type CapabilityConfiguration │ │ ├ documentation: Configuration of a single capability │ │ │ name: CapabilityConfiguration │ │ └ properties │ │ ├ Enabled: boolean │ │ └ TriggerFilterGroups: Array │ ├[+] type NetworkAccessConfiguration │ │ ├ documentation: Specifies how AWS DevOps Agent reaches your application using a release management environment. Exactly one access type must be specified. │ │ │ name: NetworkAccessConfiguration │ │ └ properties │ │ └ PrivateAccess: PrivateNetworkAccess (required) │ ├[+] type PatternFilter │ │ ├ documentation: A regex-based match condition. Passes when the value matches any pattern. │ │ │ name: PatternFilter │ │ └ properties │ │ └ Patterns: Array (required) │ ├[+] type PrivateNetworkAccess │ │ ├ documentation: Private network access to your application inside a VPC, reached through a private connection │ │ │ name: PrivateNetworkAccess │ │ └ properties │ │ ├ PrivateConnectionName: string (required) │ │ └ RuntimeRoleArn: string (required) │ ├[+] type ReleaseManagementConfiguration │ │ ├ documentation: Configuration for a release management environment. A release management environment defines how AWS DevOps Agent reaches your application, and other associations reference it to run automatic verification testing against that application. │ │ │ name: ReleaseManagementConfiguration │ │ └ properties │ │ ├ Name: string (required) │ │ └ NetworkAccess: NetworkAccessConfiguration (required) │ ├[~] type ServiceConfiguration │ │ └ properties │ │ └[+] ReleaseManagement: ReleaseManagementConfiguration │ └[+] type TriggerFilterGroup │ ├ documentation: A group of trigger conditions. The group matches when all present conditions pass. At least one condition must be present. │ │ name: TriggerFilterGroup │ └ properties │ ├ Events: Array> │ └ TargetBranches: PatternFilter ├[~] service aws-dms │ └ resources │ └[~] resource AWS::DMS::ReplicationInstance │ └ attributes │ └[+] ReplicationInstanceArn: string ├[~] service aws-docdb │ └ resources │ └[~] resource AWS::DocDB::DBClusterParameterGroup │ └ - arnTemplate: arn:${Partition}:rds:${Region}:${Account}:cluster-pg:${ClusterParameterGroupName} │ + arnTemplate: arn:${Partition}:rds:${Region}:${Account}:cluster-pg:${ClusterPGName} ├[~] service aws-dsql │ └ resources │ └[~] resource AWS::DSQL::Cluster │ ├ - vendedLogs: undefined │ │ + vendedLogs: [{"permissionsVersion":"V2","logType":"AUDIT_LOGS","destinations":[{"destinationType":"S3","outputFormats":["plain","json","w3c","parquet"]}],"optionalFields":["timestamp","resource_arn","event_timestamp","resource_id","schema_version","aws_region","cluster_id","type","database","session_id","iam_principal","iam_arn","session_user","user_id","client_application","transaction_id","statement_id","substatement_id","class","command","object_type","object_name","statement_text","parameters","rows_affected"]}] │ └ vendedLogs │ └[+] logType: AUDIT_LOGS │ ├permissionsVersion: V2 │ ├destinations: [S3] │ └optionalFields: [timestamp, resource_arn, event_timestamp, resource_id, schema_version, aws_region, cluster_id, type, database, session_id, iam_principal, iam_arn, session_user, user_id, client_application, transaction_id, statement_id, substatement_id, class, command, object_type, object_name, statement_text, parameters, rows_affected] ├[~] service aws-ec2 │ └ resources │ ├[~] resource AWS::EC2::FlowLog │ │ └ - arnTemplate: arn:${Partition}:ec2:${Region}:${Account}:vpc-flow-log/${FlowLogId} │ │ + arnTemplate: arn:${Partition}:ec2:${Region}:${Account}:vpc-flow-log/${VpcFlowLogId} │ └[~] resource AWS::EC2::Snapshot │ └ - arnTemplate: undefined │ + arnTemplate: arn:${Partition}:ec2:${Region}:${Account}:snapshot/${SnapshotId} ├[~] service aws-elasticloadbalancingv2 │ └ resources │ └[~] resource AWS::ElasticLoadBalancingV2::LoadBalancer │ ├ - vendedLogs: [{"permissionsVersion":"V2","logType":"ALB_CONNECTION_LOGS","destinations":[{"destinationType":"S3","outputFormats":["plain","json","w3c","parquet"]},{"destinationType":"CWL","outputFormats":["plain","json"]},{"destinationType":"FH","outputFormats":["plain","json","raw"]}],"mandatoryFields":["time","client_ip","client_port","listener_port","tls_protocol","tls_cipher","tls_handshake_latency","leaf_client_cert_subject","leaf_client_cert_validity","leaf_client_cert_serial_number","tls_verify_status","conn_trace_id","tls_keyexchange","elb","ip_address"]},{"permissionsVersion":"V2","logType":"ALB_HEALTH_CHECK_LOGS","destinations":[{"destinationType":"S3","outputFormats":["plain","json","w3c","parquet"]},{"destinationType":"CWL","outputFormats":["plain","json"]},{"destinationType":"FH","outputFormats":["plain","json","raw"]}],"mandatoryFields":["type","time","latency","target_addr","target_group_id","status","status_code","reason_code","elb","ip_address"]},{"permissionsVersion":"V2","logType":"NLB_ACCESS_LOGS","destinations":[{"destinationType":"S3","outputFormats":["plain","json","w3c","parquet"]},{"destinationType":"CWL","outputFormats":["plain","json"]},{"destinationType":"FH","outputFormats":["plain","json","raw"]}],"mandatoryFields":["type","version","time","elb","listener","client_port","destination_port","connection_time","tls_handshake_time","received_bytes","sent_bytes","incoming_tls_alert","chosen_cert_arn","chosen_cert_serial","tls_cipher","tls_protocol_version","tls_keyexchange","domain_name","alpn_fe_protocol","alpn_be_protocol","alpn_client_preference_list","tls_connection_creation_time"]},{"permissionsVersion":"V2","logType":"ALB_ACCESS_LOGS","destinations":[{"destinationType":"S3","outputFormats":["plain","json","w3c","parquet"]},{"destinationType":"CWL","outputFormats":["plain","json"]},{"destinationType":"FH","outputFormats":["plain","json","raw"]}],"mandatoryFields":["type","time","elb","client_port","target_port","request_processing_time","target_processing_time","response_processing_time","elb_status_code","target_status_code","received_bytes","sent_bytes","request_line","user_agent","ssl_cipher","ssl_protocol","target_group_arn","trace_id","domain_name","chosen_cert_arn","matched_rule_priority","request_creation_time","actions_executed","redirect_url","error_reason","target_port_list","target_status_code_list","classification","classification_reason","conn_trace_id","transformed_host","transformed_uri","request_transform_status","ip_address"]}] │ │ + vendedLogs: [{"permissionsVersion":"V2","logType":"ALB_CONNECTION_LOGS","destinations":[{"destinationType":"S3","outputFormats":["plain","json","w3c","parquet"]},{"destinationType":"CWL","outputFormats":["plain","json"]},{"destinationType":"FH","outputFormats":["plain","json","raw"]}],"mandatoryFields":["time","client_ip","client_port","listener_port","tls_protocol","tls_cipher","tls_handshake_latency","leaf_client_cert_subject","leaf_client_cert_validity","leaf_client_cert_serial_number","tls_verify_status","conn_trace_id","tls_keyexchange","elb","ip_address"]},{"permissionsVersion":"V2","logType":"ALB_HEALTH_CHECK_LOGS","destinations":[{"destinationType":"S3","outputFormats":["plain","json","w3c","parquet"]},{"destinationType":"CWL","outputFormats":["plain","json"]},{"destinationType":"FH","outputFormats":["plain","json","raw"]}],"mandatoryFields":["type","time","latency","target_addr","target_group_id","status","status_code","reason_code","elb","ip_address"]},{"permissionsVersion":"V2","logType":"NLB_ACCESS_LOGS","destinations":[{"destinationType":"S3","outputFormats":["plain","json","w3c","parquet"]},{"destinationType":"CWL","outputFormats":["plain","json"]},{"destinationType":"FH","outputFormats":["plain","json","raw"]}],"mandatoryFields":["type","version","time","elb","listener","client_port","destination_port","connection_time","tls_handshake_time","received_bytes","sent_bytes","incoming_tls_alert","chosen_cert_arn","chosen_cert_serial","tls_cipher","tls_protocol_version","tls_keyexchange","domain_name","alpn_fe_protocol","alpn_be_protocol","alpn_client_preference_list","tls_connection_creation_time"],"optionalFields":["tls_verify_status","leaf_client_cert_subject","leaf_client_cert_validity","leaf_client_cert_serial_number"]},{"permissionsVersion":"V2","logType":"ALB_ACCESS_LOGS","destinations":[{"destinationType":"S3","outputFormats":["plain","json","w3c","parquet"]},{"destinationType":"CWL","outputFormats":["plain","json"]},{"destinationType":"FH","outputFormats":["plain","json","raw"]}],"mandatoryFields":["type","time","elb","client_port","target_port","request_processing_time","target_processing_time","response_processing_time","elb_status_code","target_status_code","received_bytes","sent_bytes","request_line","user_agent","ssl_cipher","ssl_protocol","target_group_arn","trace_id","domain_name","chosen_cert_arn","matched_rule_priority","request_creation_time","actions_executed","redirect_url","error_reason","target_port_list","target_status_code_list","classification","classification_reason","conn_trace_id","transformed_host","transformed_uri","request_transform_status","ip_address"]}] │ └ vendedLogs │ └[~] logType: NLB_ACCESS_LOGS │ └optionalFields: │ └+ [tls_verify_status, leaf_client_cert_subject, leaf_client_cert_validity, leaf_client_cert_serial_number] ├[~] service aws-evs │ └ resources │ └[~] resource AWS::EVS::Environment │ └ types │ └[~] type HostInfoForCreate │ └ properties │ └ InstanceType: - string (required) │ + string (required) ├[~] service aws-fsx │ └ resources │ └[~] resource AWS::FSx::Backup │ └ properties │ └ FileSystemId: - string (required, immutable) │ + string (immutable) ├[~] service aws-gamelift │ └ resources │ └[~] resource AWS::GameLift::GameSessionQueue │ ├ properties │ │ └[+] LogConfiguration: LogConfiguration │ └ types │ ├[+] type DeliveryDestination │ │ ├ documentation: The destination to deliver a game session queue's placement logs to. Omit DestinationArn for a CLOUDWATCH or S3 destination to have GameLift create one; FIREHOSE requires DestinationArn. │ │ │ name: DeliveryDestination │ │ └ properties │ │ ├ LogDestination: string (required) │ │ └ DestinationArn: string │ └[+] type LogConfiguration │ ├ documentation: A policy that determines where a game session queue's placement logs are delivered. │ │ name: LogConfiguration │ └ properties │ └ DeliveryDestinations: Array (required) ├[~] service aws-globalaccelerator │ └ resources │ └[~] resource AWS::GlobalAccelerator::Accelerator │ └ - arnTemplate: arn:${Partition}:globalaccelerator::${Account}:accelerator/${AcceleratorId} │ + arnTemplate: arn:${Partition}:globalaccelerator::${Account}:accelerator/${ResourceId} ├[~] service aws-glue │ └ resources │ ├[~] resource AWS::Glue::Catalog │ │ └ attributes │ │ ├ CreateTime: - integer │ │ │ + string │ │ └ UpdateTime: - integer │ │ + string │ └[~] resource AWS::Glue::Job │ └ properties │ └ WorkerType: - string │ + string ├[~] service aws-kinesisanalyticsv2 │ └ resources │ └[~] resource AWS::KinesisAnalyticsV2::Application │ └ types │ ├[~] type InputSchema │ │ └ properties │ │ └ RecordEncoding: - string │ │ + string │ └[~] type RecordFormat │ └ properties │ └ RecordFormatType: - string (required) │ + string (required) ├[~] service aws-lambda │ └ resources │ ├[~] resource AWS::Lambda::MicrovmImage │ │ └ types │ │ └[~] type CpuConfiguration │ │ └ properties │ │ └ Architecture: - string (required) │ │ + string (required) │ └[~] resource AWS::Lambda::NetworkConnector │ └ types │ └[~] type VpcEgressConfiguration │ └ properties │ └[-] ElasticIpConfiguration: json ├[~] service aws-mediaconnect │ └ resources │ ├[~] resource AWS::MediaConnect::DestinationEndpoint │ │ └ - arnTemplate: undefined │ │ + arnTemplate: arn:${Partition}:mediaconnect:${Region}:${Account}:destinationEndpoint:${DestinationEndpointId} │ └[~] resource AWS::MediaConnect::SourceEndpoint │ └ - arnTemplate: undefined │ + arnTemplate: arn:${Partition}:mediaconnect:${Region}:${Account}:sourceEndpoint:${SourceEndpointId} ├[~] service aws-medialive │ └ resources │ ├[~] resource AWS::MediaLive::Channel │ │ └ types │ │ ├[+] type Av1FilterSettings │ │ │ ├ name: Av1FilterSettings │ │ │ └ properties │ │ │ ├ AutoFilterSettings: json │ │ │ ├ NoneFilterSettings: json │ │ │ └ PerceptualFilterSettings: PerceptualFilterSettings │ │ ├[~] type Av1Settings │ │ │ └ properties │ │ │ └[+] FilterSettings: Av1FilterSettings │ │ ├[~] type H264FilterSettings │ │ │ └ properties │ │ │ ├[+] AutoFilterSettings: json │ │ │ ├[+] NoneFilterSettings: json │ │ │ └[+] PerceptualFilterSettings: PerceptualFilterSettings │ │ ├[~] type H264Settings │ │ │ └ properties │ │ │ └[+] AllowExplicitWeightedPrediction: string │ │ ├[~] type H265FilterSettings │ │ │ └ properties │ │ │ ├[+] AutoFilterSettings: json │ │ │ ├[+] NoneFilterSettings: json │ │ │ └[+] PerceptualFilterSettings: PerceptualFilterSettings │ │ └[+] type PerceptualFilterSettings │ │ ├ name: PerceptualFilterSettings │ │ └ properties │ │ └ Strength: string │ └[~] resource AWS::MediaLive::CloudWatchAlarmTemplate │ └ properties │ └ TargetResourceType: - string (required) │ + string (required) ├[~] service aws-mediatailor │ └ resources │ └[~] resource AWS::MediaTailor::SourceLocation │ └ - arnTemplate: arn:${Partition}:mediatailor:${Region}:${Account}:sourceLocation/${ResourceId} │ + arnTemplate: arn:${Partition}:mediatailor:${Region}:${Account}:sourceLocation/${SourceLocationName} ├[~] service aws-mgn │ └ resources │ ├[~] resource AWS::MGN::Application │ │ └ - arnTemplate: undefined │ │ + arnTemplate: arn:${Partition}:mgn:${Region}:${Account}:application/${ApplicationID} │ └[~] resource AWS::MGN::ReplicationConfigurationTemplate │ └ - arnTemplate: undefined │ + arnTemplate: arn:${Partition}:mgn:${Region}:${Account}:replication-configuration-template/${RctID} ├[~] service aws-neptune │ └ resources │ └[~] resource AWS::Neptune::DBClusterParameterGroup │ └ - arnTemplate: arn:${Partition}:rds:${Region}:${Account}:cluster-pg:${ClusterParameterGroupName} │ + arnTemplate: arn:aws:rds:${Region}:${Account}:cluster-pg:${ClusterPGName} ├[~] service aws-networkfirewall │ └ resources │ └[~] resource AWS::NetworkFirewall::RuleGroup │ └ - arnTemplate: arn:${Partition}:network-firewall:${Region}:${Account}:stateful-rulegroup/${Name} │ + arnTemplate: arn:${Partition}:network-firewall:${Region}:${Account}:stateless-rulegroup/${Name} ├[~] service aws-networkmanager │ └ resources │ ├[~] resource AWS::NetworkManager::ConnectAttachment │ │ ├ properties │ │ │ ├[+] NatGatewayRules: Array │ │ │ └[+] NatGatewaySupport: string │ │ ├ attributes │ │ │ └[+] NatSystemRouteSupport: boolean │ │ └ types │ │ └[+] type NatRule │ │ ├ documentation: A NAT gateway rule on the attachment. │ │ │ name: NatRule │ │ └ properties │ │ ├ RuleNumber: integer (required) │ │ ├ MatchSourceCidr: string (required) │ │ └ NatCidr: string (required) │ ├[~] resource AWS::NetworkManager::DirectConnectGatewayAttachment │ │ ├ properties │ │ │ ├[+] NatGatewayRules: Array │ │ │ ├[+] NatGatewaySupport: string │ │ │ └[+] NatSystemRouteSupport: boolean │ │ └ types │ │ └[+] type NatRule │ │ ├ documentation: A NAT gateway rule on the attachment. │ │ │ name: NatRule │ │ └ properties │ │ ├ RuleNumber: integer (required) │ │ ├ MatchSourceCidr: string (required) │ │ └ NatCidr: string (required) │ ├[~] resource AWS::NetworkManager::GlobalNetwork │ │ └ - arnTemplate: arn:${Partition}:networkmanager::${Account}:global-network/${GlobalNetworkId} │ │ + arnTemplate: arn:${Partition}:networkmanager::${Account}:global-network/${ResourceId} │ ├[~] resource AWS::NetworkManager::SiteToSiteVpnAttachment │ │ ├ properties │ │ │ ├[+] NatGatewayRules: Array │ │ │ ├[+] NatGatewaySupport: string │ │ │ └[+] NatSystemRouteSupport: boolean │ │ └ types │ │ └[+] type NatRule │ │ ├ documentation: A NAT gateway rule on the attachment. │ │ │ name: NatRule │ │ └ properties │ │ ├ RuleNumber: integer (required) │ │ ├ MatchSourceCidr: string (required) │ │ └ NatCidr: string (required) │ └[~] resource AWS::NetworkManager::VpcAttachment │ ├ properties │ │ ├[+] NatGatewayRules: Array │ │ └[+] NatGatewaySupport: string │ ├ attributes │ │ └[+] NatSystemRouteSupport: boolean │ └ types │ └[+] type NatRule │ ├ documentation: A NAT gateway rule on the attachment. │ │ name: NatRule │ └ properties │ ├ RuleNumber: integer (required) │ ├ MatchSourceCidr: string (required) │ └ NatCidr: string (required) ├[~] service aws-opsworks │ └ resources │ ├[~] resource AWS::OpsWorks::Instance │ │ └ - arnTemplate: undefined │ │ + arnTemplate: arn:${Partition}:opsworks:${Region}:${Account}:instance/${UUID} │ ├[~] resource AWS::OpsWorks::Layer │ │ └ - arnTemplate: undefined │ │ + arnTemplate: arn:${Partition}:opsworks:${Region}:${Account}:layer/${UUID} │ └[~] resource AWS::OpsWorks::Stack │ └ - arnTemplate: undefined │ + arnTemplate: arn:${Partition}:opsworks:${Region}:${Account}:stack/${StackId} ├[~] service aws-osis │ └ resources │ └[~] resource AWS::OSIS::PipelineEndpoint │ └ - arnTemplate: undefined │ + arnTemplate: arn:${Partition}:osis:${Region}:${Account}:endpoint/${EndpointId} ├[~] service aws-paymentcryptography │ └ resources │ └[~] resource AWS::PaymentCryptography::Key │ └ types │ └[~] type ReplicationStatusType │ └ properties │ ├[+] KmsEncryptionKeyArn: string │ ├[+] KmsEncryptionKeyId: string │ ├[-] KmsKeyArn: string │ └[-] KmsKeyId: string ├[~] service aws-pcs │ └ resources │ └[~] resource AWS::PCS::ComputeNodeGroup │ └ properties │ ├[+] LaunchTemplateMode: string │ ├[+] SecurityGroupIds: Array │ └[+] SshKeyName: string ├[~] service aws-quicksight │ └ resources │ ├[~] resource AWS::QuickSight::Analysis │ │ └ types │ │ ├[~] type AssetOptions │ │ │ └ properties │ │ │ ├[+] CustomActionDefaults: VisualCustomActionDefaults │ │ │ └[+] VisualMessages: VisualMessages │ │ ├[~] type ResourcePermission │ │ │ └ properties │ │ │ └ Principal: (documentation changed) │ │ ├[~] type SheetDefinition │ │ │ └ properties │ │ │ └[+] CustomActionDefaults: VisualCustomActionDefaults │ │ ├[+] type VisualCustomActionDefaults │ │ │ ├ name: VisualCustomActionDefaults │ │ │ └ properties │ │ │ └ HighlightOperation: VisualHighlightOperation │ │ ├[+] type VisualHighlightOperation │ │ │ ├ name: VisualHighlightOperation │ │ │ └ properties │ │ │ └ Trigger: string (required) │ │ ├[+] type VisualMessageConfiguration │ │ │ ├ name: VisualMessageConfiguration │ │ │ └ properties │ │ │ ├ TitleVisibility: string │ │ │ ├ Description: string │ │ │ ├ LinkUrl: string │ │ │ ├ LinkVisibility: string │ │ │ ├ Enabled: boolean (default=false) │ │ │ ├ Title: string │ │ │ ├ DescriptionVisibility: string │ │ │ └ LinkText: string │ │ └[+] type VisualMessages │ │ ├ name: VisualMessages │ │ └ properties │ │ └ NoDataMessage: VisualMessageConfiguration │ ├[~] resource AWS::QuickSight::Dashboard │ │ ├ - arnTemplate: arn:${Partition}:quicksight:${Region}:${Account}:dashboard/${ResourceId} │ │ │ + arnTemplate: arn:${Partition}:quicksight:${Region}:${Account}:dashboard/${DashboardId} │ │ └ types │ │ ├[~] type AssetOptions │ │ │ └ properties │ │ │ ├[+] CustomActionDefaults: VisualCustomActionDefaults │ │ │ └[+] VisualMessages: VisualMessages │ │ ├[~] type ResourcePermission │ │ │ └ properties │ │ │ └ Principal: (documentation changed) │ │ ├[~] type SheetDefinition │ │ │ └ properties │ │ │ └[+] CustomActionDefaults: VisualCustomActionDefaults │ │ ├[+] type VisualCustomActionDefaults │ │ │ ├ name: VisualCustomActionDefaults │ │ │ └ properties │ │ │ └ HighlightOperation: VisualHighlightOperation │ │ ├[+] type VisualHighlightOperation │ │ │ ├ name: VisualHighlightOperation │ │ │ └ properties │ │ │ └ Trigger: string (required) │ │ ├[+] type VisualMessageConfiguration │ │ │ ├ name: VisualMessageConfiguration │ │ │ └ properties │ │ │ ├ TitleVisibility: string │ │ │ ├ Description: string │ │ │ ├ LinkUrl: string │ │ │ ├ LinkVisibility: string │ │ │ ├ Enabled: boolean (default=false) │ │ │ ├ Title: string │ │ │ ├ DescriptionVisibility: string │ │ │ └ LinkText: string │ │ └[+] type VisualMessages │ │ ├ name: VisualMessages │ │ └ properties │ │ └ NoDataMessage: VisualMessageConfiguration │ ├[~] resource AWS::QuickSight::DataSet │ │ └ types │ │ └[~] type ResourcePermission │ │ └ properties │ │ └ Principal: (documentation changed) │ ├[~] resource AWS::QuickSight::DataSource │ │ └ types │ │ └[~] type ResourcePermission │ │ └ properties │ │ └ Principal: (documentation changed) │ ├[~] resource AWS::QuickSight::Folder │ │ └ - arnTemplate: arn:${Partition}:quicksight:${Region}:${Account}:folder/${FolderId} │ │ + arnTemplate: arn:${Partition}:quicksight:${Region}:${Account}:folder/${ResourceId} │ ├[~] resource AWS::QuickSight::Group │ │ └ - arnTemplate: arn:${Partition}:quicksight:${Region}:${Account}:group/${ResourceId} │ │ + arnTemplate: undefined │ ├[~] resource AWS::QuickSight::Template │ │ └ types │ │ ├[~] type AssetOptions │ │ │ └ properties │ │ │ ├[+] CustomActionDefaults: VisualCustomActionDefaults │ │ │ └[+] VisualMessages: VisualMessages │ │ ├[~] type ResourcePermission │ │ │ └ properties │ │ │ └ Principal: (documentation changed) │ │ ├[~] type SheetDefinition │ │ │ └ properties │ │ │ └[+] CustomActionDefaults: VisualCustomActionDefaults │ │ ├[+] type VisualCustomActionDefaults │ │ │ ├ name: VisualCustomActionDefaults │ │ │ └ properties │ │ │ └ HighlightOperation: VisualHighlightOperation │ │ ├[+] type VisualHighlightOperation │ │ │ ├ name: VisualHighlightOperation │ │ │ └ properties │ │ │ └ Trigger: string (required) │ │ ├[+] type VisualMessageConfiguration │ │ │ ├ name: VisualMessageConfiguration │ │ │ └ properties │ │ │ ├ TitleVisibility: string │ │ │ ├ Description: string │ │ │ ├ LinkUrl: string │ │ │ ├ LinkVisibility: string │ │ │ ├ Enabled: boolean (default=false) │ │ │ ├ Title: string │ │ │ ├ DescriptionVisibility: string │ │ │ └ LinkText: string │ │ └[+] type VisualMessages │ │ ├ name: VisualMessages │ │ └ properties │ │ └ NoDataMessage: VisualMessageConfiguration │ └[~] resource AWS::QuickSight::Theme │ ├ - documentation: Creates a theme. │ │ A *theme* is set of configuration options for color and layout. Themes apply to analyses and dashboards. For more information, see [Using Themes in Amazon Quick](https://docs.aws.amazon.com/quicksight/latest/user/themes-in-quicksight.html) in the *Amazon Quick User Guide* . │ │ + documentation: Creates a theme. │ │ A *theme* is set of configuration options for color and layout. Themes apply to analyses and dashboards. For more information, see [Using Themes in AWS Quick](https://docs.aws.amazon.com/quicksight/latest/user/themes-in-quicksight.html) in the *AWS Quick User Guide* . │ └ types │ ├[~] type ResourcePermission │ │ └ properties │ │ └ Principal: (documentation changed) │ └[~] type UIColorPalette │ └ - documentation: The theme colors that apply to UI and to charts, excluding data colors. The colors description is a hexadecimal color code that consists of six alphanumerical characters, prefixed with `#` , for example #37BFF5. For more information, see [Using Themes in Amazon Quick](https://docs.aws.amazon.com/quicksight/latest/user/themes-in-quicksight.html) in the *Amazon Quick User Guide.* │ + documentation: The theme colors that apply to UI and to charts, excluding data colors. The colors description is a hexadecimal color code that consists of six alphanumerical characters, prefixed with `#` , for example #37BFF5. For more information, see [Using Themes in AWS Quick](https://docs.aws.amazon.com/quicksight/latest/user/themes-in-quicksight.html) in the *AWS Quick User Guide.* ├[~] service aws-s3tables │ └ resources │ └[~] resource AWS::S3Tables::TableBucket │ ├ properties │ │ └[+] LoggingConfiguration: LoggingConfiguration │ └ types │ ├[+] type LoggingConfiguration │ │ ├ documentation: Describes where logs are stored and the prefix that Amazon S3 assigns to all log object keys for a table bucket. │ │ │ name: LoggingConfiguration │ │ └ properties │ │ ├ TargetBucket: string (required) │ │ ├ TargetPrefix: string (required) │ │ └ TargetObjectKeyFormat: TargetObjectKeyFormat (required) │ ├[+] type PartitionedPrefix │ │ ├ documentation: Amazon S3 keys for log objects are partitioned in the following format: [TargetPrefix][SourceAccountId]/[SourceRegion]/[SourceTableBucket]/[YYYY]/[MM]/[DD]/[YYYY]-[MM]-[DD]-[hh]-[mm]-[ss]-[UniqueString] │ │ │ name: PartitionedPrefix │ │ └ properties │ │ └ PartitionDateSource: string (required) │ └[+] type TargetObjectKeyFormat │ ├ documentation: The key format of the log objects. Only PartitionedPrefix is supported. │ │ name: TargetObjectKeyFormat │ └ properties │ └ PartitionedPrefix: PartitionedPrefix (required) ├[~] service aws-securityhub │ └ resources │ └[~] resource AWS::SecurityHub::HubV2 │ ├ properties │ │ └ NetworkScanning: (documentation changed) │ └ types │ └[~] type NetworkScanning │ └ - documentation: Configuration for the Network Scanning opt-in feature of Security Hub V2. Network Scanning is available in the AWS commercial partition only; specifying this property in another partition, such as AWS GovCloud (US) or China, fails. This property is desired state: if you remove it from a stack that previously set it, the feature is disabled. If a stack has never set it, the feature is left as-is, so a stack that does not manage Network Scanning will not disable it. Network Scanning requires Security Hub V2 to be enabled in the same account and Region. │ + documentation: Configuration for the Network Scanning opt-in feature of Security Hub V2. Network Scanning is available in the AWS commercial and AWS GovCloud (US) partitions only; specifying this property in another partition, such as China, fails. This property is desired state: if you remove it from a stack that previously set it, the feature is disabled. If a stack has never set it, the feature is left as-is, so a stack that does not manage Network Scanning will not disable it. Network Scanning requires Security Hub V2 to be enabled in the same account and Region. ├[~] service aws-ses │ └ resources │ └[~] resource AWS::SES::CustomVerificationEmailTemplate │ └ properties │ └ Tags: (documentation changed) ├[~] service aws-wafv2 │ └ resources │ ├[~] resource AWS::WAFv2::RuleGroup │ │ └ types │ │ ├[+] type ConnectedAccountChainConfig │ │ │ ├ documentation: Per-chain price configuration for a connected account. The deposit address is provisioned by the payments provider and is not specified here. │ │ │ │ name: ConnectedAccountChainConfig │ │ │ └ properties │ │ │ ├ Chain: string (required) │ │ │ └ Prices: Array (required) │ │ ├[+] type ConnectedAccountConfig │ │ │ ├ documentation: Configuration for a single connected account and the chains it accepts payment on. │ │ │ │ name: ConnectedAccountConfig │ │ │ └ properties │ │ │ ├ ConnectedAccountArn: string (required) │ │ │ └ PaymentNetworks: Array (required) │ │ ├[+] type ConnectedAccountPrice │ │ │ ├ documentation: A connected-account price configuration. The payment provider rejects amounts below $0.01 and does not support sub-cent amounts. │ │ │ │ name: ConnectedAccountPrice │ │ │ └ properties │ │ │ ├ Amount: string (required) │ │ │ └ Currency: string (required) │ │ └[~] type MonetizationConfig │ │ └ properties │ │ └[+] ConnectedAccountConfigs: Array │ └[~] resource AWS::WAFv2::WebACL │ └ types │ ├[+] type ConnectedAccountChainConfig │ │ ├ documentation: Per-chain price configuration for a connected account. The deposit address is provisioned by the payments provider and is not specified here. │ │ │ name: ConnectedAccountChainConfig │ │ └ properties │ │ ├ Chain: string (required) │ │ └ Prices: Array (required) │ ├[+] type ConnectedAccountConfig │ │ ├ documentation: Configuration for a single connected account and the chains it accepts payment on. │ │ │ name: ConnectedAccountConfig │ │ └ properties │ │ ├ PaymentNetworks: Array (required) │ │ └ ConnectedAccountArn: string (required) │ ├[+] type ConnectedAccountPrice │ │ ├ documentation: A connected-account price configuration. The payment provider rejects amounts below $0.01 and does not support sub-cent amounts. │ │ │ name: ConnectedAccountPrice │ │ └ properties │ │ ├ Amount: string (required) │ │ └ Currency: string (required) │ └[~] type MonetizationConfig │ └ properties │ └[+] ConnectedAccountConfigs: Array └[~] service aws-wellarchitected └ resources ├[+] resource AWS::WellArchitected::AgentOrganizationalProfile │ ├ name: AgentOrganizationalProfile │ │ cloudFormationType: AWS::WellArchitected::AgentOrganizationalProfile │ │ documentation: Resource Type definition for AWS::WellArchitected::AgentOrganizationalProfile. An Agent Organizational Profile is an Agent Profile scoped to an AWS Organization; the organization is inferred from the caller's identity, and the profile does not carry a single-account execution role or aggregation configuration. Only usable in the AWS Organizations management or delegated-admin account. │ │ tagInformation: {"tagPropertyName":"Tags","variant":"standard"} │ │ primaryIdentifier: ["Arn"] │ ├ properties │ │ ├ Name: string (required, immutable) │ │ ├ DisplayName: string │ │ ├ Description: string │ │ ├ BusinessOverview: string │ │ ├ Pillars: Array> (required) │ │ ├ DeletionProtection: boolean │ │ └ Tags: Array │ └ attributes │ ├ Arn: string │ ├ CreatedBy: string │ ├ CreatedAt: string │ ├ LastModifiedBy: string │ └ LastModifiedAt: string └[+] resource AWS::WellArchitected::AgentProfilePolicy ├ name: AgentProfilePolicy │ cloudFormationType: AWS::WellArchitected::AgentProfilePolicy │ documentation: Resource schema for AWS::WellArchitected::AgentProfilePolicy. Attaches an IAM resource-based policy to an Agent Profile controlling cross-account access to the profile and its child resources (recommendations, goals, contexts). One policy per profile: the parent profile's ARN is the primary identifier. Standard CloudFormation policy-attachment pattern (see AWS::S3::BucketPolicy). │ primaryIdentifier: ["ProfileArn"] └ properties ├ ProfileArn: string (required, immutable) └ Policy: string (required)