Repository: boto/botocore
Pull request #2704 (2022-06-21 22:07:04)

Warn users of `sslCommonName` deprecation.
This somewhat addresses https://github.com/boto/botocore/issues/2376. Since we changes to endpoints are coming soon, we aren't addressing the root of the problem at the moment, but sending a warning that it will be soon.

codecov-commenter: # [Codecov](https://codecov.io/gh/boto/botocore/pull/2704?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=boto) Report
> Merging [#2704](https://codecov.io/gh/boto/botocore/pull/2704?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=boto) (0ef3878) into [develop](https://codecov.io/gh/boto/botocore/commit/40cd30e85c4ec7f7d1f6571263ed08611c0a42cd?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=boto) (40cd30e) will **decrease** coverage by `0.02%`.
> The diff coverage is `100.00%`.

```diff
@@             Coverage Diff             @@
##           develop    #2704      +/-   ##
===========================================
- Coverage    95.22%   95.20%   -0.03%     
===========================================
  Files           60       60              
  Lines        12283    12283              
===========================================
- Hits         11697    11694       -3     
- Misses         586      589       +3     
```


| [Impacted Files](https://codecov.io/gh/boto/botocore/pull/2704?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=boto) | Coverage Δ | |
|---|---|---|
| [botocore/client.py](https://codecov.io/gh/boto/botocore/pull/2704/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=boto#diff-Ym90b2NvcmUvY2xpZW50LnB5) | `98.74% <100.00%> (+0.01%)` | :arrow_up: |
| [botocore/compat.py](https://codecov.io/gh/boto/botocore/pull/2704/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=boto#diff-Ym90b2NvcmUvY29tcGF0LnB5) | `91.27% <0.00%> (-1.35%)` | :arrow_down: |
| [botocore/httpsession.py](https://codecov.io/gh/boto/botocore/pull/2704/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=boto#diff-Ym90b2NvcmUvaHR0cHNlc3Npb24ucHk=) | `91.33% <0.00%> (-0.40%)` | :arrow_down: |
| [botocore/utils.py](https://codecov.io/gh/boto/botocore/pull/2704/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=boto#diff-Ym90b2NvcmUvdXRpbHMucHk=) | `93.38% <0.00%> (-0.23%)` | :arrow_down: |
| [botocore/credentials.py](https://codecov.io/gh/boto/botocore/pull/2704/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=boto#diff-Ym90b2NvcmUvY3JlZGVudGlhbHMucHk=) | `98.54% <0.00%> (-0.11%)` | :arrow_down: |
| [botocore/docs/shape.py](https://codecov.io/gh/boto/botocore/pull/2704/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=boto#diff-Ym90b2NvcmUvZG9jcy9zaGFwZS5weQ==) | `95.34% <0.00%> (+7.84%)` | :arrow_up: |

------

[Continue to review full report at Codecov](https://codecov.io/gh/boto/botocore/pull/2704?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=boto).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=boto)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/boto/botocore/pull/2704?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=boto). Last update [40cd30e...0ef3878](https://codecov.io/gh/boto/botocore/pull/2704?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=boto). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=boto).


Patch:
diff --git a/.changes/1.27.19.json b/.changes/1.27.19.json
new file mode 100644
index 000000000..f67f25e3f
--- /dev/null
+++ b/.changes/1.27.19.json
@@ -0,0 +1,22 @@
+[
+  {
+    "category": "``datasync``",
+    "description": "AWS DataSync now supports Amazon FSx for NetApp ONTAP locations.",
+    "type": "api-change"
+  },
+  {
+    "category": "``ec2``",
+    "description": "This release adds a new spread placement group to EC2 Placement Groups: host level spread, which spread instances between physical hosts, available to Outpost customers only. CreatePlacementGroup and DescribePlacementGroups APIs were updated with a new parameter: SpreadLevel to support this feature.",
+    "type": "api-change"
+  },
+  {
+    "category": "``finspace-data``",
+    "description": "Release new API GetExternalDataViewAccessDetails",
+    "type": "api-change"
+  },
+  {
+    "category": "``polly``",
+    "description": "Add 4 new neural voices - Pedro (es-US), Liam (fr-CA), Daniel (de-DE) and Arthur (en-GB).",
+    "type": "api-change"
+  }
+]
\ No newline at end of file
diff --git a/CHANGELOG.rst b/CHANGELOG.rst
index d868ba609..1577a5d9d 100644
--- a/CHANGELOG.rst
+++ b/CHANGELOG.rst
@@ -2,6 +2,15 @@
 CHANGELOG
 =========
 
+1.27.19
+=======
+
+* api-change:``datasync``: AWS DataSync now supports Amazon FSx for NetApp ONTAP locations.
+* api-change:``ec2``: This release adds a new spread placement group to EC2 Placement Groups: host level spread, which spread instances between physical hosts, available to Outpost customers only. CreatePlacementGroup and DescribePlacementGroups APIs were updated with a new parameter: SpreadLevel to support this feature.
+* api-change:``finspace-data``: Release new API GetExternalDataViewAccessDetails
+* api-change:``polly``: Add 4 new neural voices - Pedro (es-US), Liam (fr-CA), Daniel (de-DE) and Arthur (en-GB).
+
+
 1.27.18
 =======
 
diff --git a/botocore/__init__.py b/botocore/__init__.py
index ed839093d..652493e1d 100644
--- a/botocore/__init__.py
+++ b/botocore/__init__.py
@@ -16,7 +16,7 @@ import logging
 import os
 import re
 
-__version__ = '1.27.18'
+__version__ = '1.27.19'
 
 
 class NullHandler(logging.Handler):
diff --git a/botocore/client.py b/botocore/client.py
index d54c47eac..6d3bd3acf 100644
--- a/botocore/client.py
+++ b/botocore/client.py
@@ -11,6 +11,8 @@
 # ANY KIND, either express or implied. See the License for the specific
 # language governing permissions and limitations under the License.
 import logging
+import os
+import warnings
 
 from botocore import waiter, xform_name
 from botocore.args import ClientArgsCreator
@@ -606,8 +608,21 @@ class ClientEndpointBridge:
             resolved, region_name, endpoint_url
         )
         if endpoint_url is None:
-            # Use the sslCommonName over the hostname for Python 2.6 compat.
-            hostname = resolved.get('sslCommonName', resolved.get('hostname'))
+            sslCommonName = resolved.get('sslCommonName')
+            hostname = resolved.get('hostname')
+            is_disabled = ensure_boolean(
+                os.environ.get('BOTO_DISABLE_COMMONNAME', False)
+            )
+            if not is_disabled and sslCommonName is not None:
+                warnings.warn(
+                    f'The {service_name} client is currently using a '
+                    f'deprecated endpoint: {sslCommonName}. In the next '
+                    f'minor version this will be moved to {hostname}. '
+                    'See https://github.com/boto/botocore/issues/2705 '
+                    'for more details.',
+                    category=FutureWarning,
+                )
+                hostname = sslCommonName
             endpoint_url = self._make_url(
                 hostname, is_secure, resolved.get('protocols', [])
             )
diff --git a/botocore/data/datasync/2018-11-09/service-2.json b/botocore/data/datasync/2018-11-09/service-2.json
index 2c6e18abd..92e402363 100644
--- a/botocore/data/datasync/2018-11-09/service-2.json
+++ b/botocore/data/datasync/2018-11-09/service-2.json
@@ -70,6 +70,20 @@
       ],
       "documentation":"<p>Creates an endpoint for an Amazon FSx for Lustre file system.</p>"
     },
+    "CreateLocationFsxOntap":{
+      "name":"CreateLocationFsxOntap",
+      "http":{
+        "method":"POST",
+        "requestUri":"/"
+      },
+      "input":{"shape":"CreateLocationFsxOntapRequest"},
+      "output":{"shape":"CreateLocationFsxOntapResponse"},
+      "errors":[
+        {"shape":"InvalidRequestException"},
+        {"shape":"InternalException"}
+      ],
+      "documentation":"<p>Creates an endpoint for an Amazon FSx for NetApp ONTAP file system that DataSync can access for a transfer. For more information, see <a href=\"https://docs.aws.amazon.com/datasync/latest/userguide/create-ontap-location.html\">Creating a location for FSx for ONTAP</a>.</p>"
+    },
     "CreateLocationFsxOpenZfs":{
       "name":"CreateLocationFsxOpenZfs",
       "http":{
@@ -138,7 +152,7 @@
         {"shape":"InvalidRequestException"},
         {"shape":"InternalException"}
       ],
-      "documentation":"<p>Creates an endpoint for a self-managed object storage bucket. For more information about self-managed object storage locations, see <a href=\"https://docs.aws.amazon.com/datasync/latest/userguide/create-object-location.html\">Creating a location for object storage</a>.</p>"
+      "documentation":"<p>Creates an endpoint for an object storage system that DataSync can access for a transfer. For more information, see <a href=\"https://docs.aws.amazon.com/datasync/latest/userguide/create-object-location.html\">Creating a location for object storage</a>.</p>"
     },
     "CreateLocationS3":{
       "name":"CreateLocationS3",
@@ -266,6 +280,20 @@
       ],
       "documentation":"<p>Returns metadata about an Amazon FSx for Lustre location, such as information about its path.</p>"
     },
+    "DescribeLocationFsxOntap":{
+      "name":"DescribeLocationFsxOntap",
+      "http":{
+        "method":"POST",
+        "requestUri":"/"
+      },
+      "input":{"shape":"DescribeLocationFsxOntapRequest"},
+      "output":{"shape":"DescribeLocationFsxOntapResponse"},
+      "errors":[
+        {"shape":"InvalidRequestException"},
+        {"shape":"InternalException"}
+      ],
+      "documentation":"<p>Provides details about how an DataSync location for an Amazon FSx for NetApp ONTAP file system is configured.</p>"
+    },
     "DescribeLocationFsxOpenZfs":{
       "name":"DescribeLocationFsxOpenZfs",
       "http":{
@@ -334,7 +362,7 @@
         {"shape":"InvalidRequestException"},
         {"shape":"InternalException"}
       ],
-      "documentation":"<p>Returns metadata about a self-managed object storage server location. For more information about self-managed object storage locations, see <a href=\"https://docs.aws.amazon.com/datasync/latest/userguide/create-object-location.html\">Creating a location for object storage</a>.</p>"
+      "documentation":"<p>Returns metadata about your DataSync location for an object storage system.</p>"
     },
     "DescribeLocationS3":{
       "name":"DescribeLocationS3",
@@ -750,7 +778,7 @@
         },
         "InTransitEncryption":{
           "shape":"EfsInTransitEncryption",
-          "documentation":"<p>Specifies whether you want DataSync to use TLS encryption when transferring data to or from your Amazon EFS file system.</p> <p>If you specify an access point using <code>AccessPointArn</code> or an IAM role using <code>FileSystemAccessRoleArn</code>, you must set this parameter to <code>TLS1_2</code>.</p>"
+          "documentation":"<p>Specifies whether you want DataSync to use Transport Layer Security (TLS) 1.2 encryption when it copies data to or from the Amazon EFS file system.</p> <p>If you specify an access point using <code>AccessPointArn</code> or an IAM role using <code>FileSystemAccessRoleArn</code>, you must set this parameter to <code>TLS1_2</code>.</p>"
         }
       },
       "documentation":"<p>CreateLocationEfsRequest</p>"
@@ -799,6 +827,42 @@
         }
       }
     },
+    "CreateLocationFsxOntapRequest":{
+      "type":"structure",
+      "required":[
+        "Protocol",
+        "SecurityGroupArns",
+        "StorageVirtualMachineArn"
+      ],
+      "members":{
+        "Protocol":{"shape":"FsxProtocol"},
+        "SecurityGroupArns":{
+          "shape":"Ec2SecurityGroupArnList",
+          "documentation":"<p>Specifies the security groups that DataSync can use to access your FSx for ONTAP file system. You must configure the security groups to allow outbound traffic on the following ports (depending on the protocol that you're using):</p> <ul> <li> <p> <b>Network File System (NFS)</b>: TCP port 2049</p> </li> <li> <p> <b>Server Message Block (SMB)</b>: TCP port 445</p> </li> </ul> <p>Your file system's security groups must also allow inbound traffic on the same port.</p>"
+        },
+        "StorageVirtualMachineArn":{
+          "shape":"StorageVirtualMachineArn",
+          "documentation":"<p>Specifies the ARN of the storage virtual machine (SVM) on your file system where you're copying data to or from.</p>"
+        },
+        "Subdirectory":{
+          "shape":"FsxOntapSubdirectory",
+          "documentation":"<p>Specifies the junction path (also known as a mount point) in the SVM volume where you're copying data to or from (for example, <code>/vol1</code>).</p> <note> <p>Don't specify a junction path in the SVM's root volume. For more information, see <a href=\"https://docs.aws.amazon.com/fsx/latest/ONTAPGuide/managing-svms.html\">Managing FSx for ONTAP storage virtual machines</a> in the <i>Amazon FSx for NetApp ONTAP User Guide</i>.</p> </note>"
+        },
+        "Tags":{
+          "shape":"InputTagList",
+          "documentation":"<p>Specifies labels that help you categorize, filter, and search for your Amazon Web Services resources. We recommend creating at least a name tag for your location.</p>"
+        }
+      }
+    },
+    "CreateLocationFsxOntapResponse":{
+      "type":"structure",
+      "members":{
+        "LocationArn":{
+          "shape":"LocationArn",
+          "documentation":"<p>Specifies the ARN of the FSx for ONTAP file system location that you create.</p>"
+        }
+      }
+    },
     "CreateLocationFsxOpenZfsRequest":{
       "type":"structure",
       "required":[
@@ -1008,39 +1072,39 @@
       "members":{
         "ServerHostname":{
           "shape":"ServerHostname",
-          "documentation":"<p>The name of the self-managed object storage server. This value is the IP address or Domain Name Service (DNS) name of the object storage server. An agent uses this hostname to mount the object storage server in a network. </p>"
+          "documentation":"<p>Specifies the domain name or IP address of the object storage server. A DataSync agent uses this hostname to mount the object storage server in a network.</p>"
         },
         "ServerPort":{
           "shape":"ObjectStorageServerPort",
-          "documentation":"<p>The port that your self-managed object storage server accepts inbound network traffic on. The server port is set by default to TCP 80 (HTTP) or TCP 443 (HTTPS). You can specify a custom port if your self-managed object storage server requires one.</p>"
+          "documentation":"<p>Specifies the port that your object storage server accepts inbound network traffic on (for example, port 443).</p>"
         },
         "ServerProtocol":{
           "shape":"ObjectStorageServerProtocol",
-          "documentation":"<p>The protocol that the object storage server uses to communicate. Valid values are HTTP or HTTPS.</p>"
+          "documentation":"<p>Specifies the protocol that your object storage server uses to communicate.</p>"
         },
         "Subdirectory":{
           "shape":"S3Subdirectory",
-          "documentation":"<p>The subdirectory in the self-managed object storage server that is used to read data from.</p>"
+          "documentation":"<p>Specifies the object prefix for your object storage server. If this is a source location, DataSync only copies objects with this prefix. If this is a destination location, DataSync writes all objects with this prefix. </p>"
         },
         "BucketName":{
           "shape":"ObjectStorageBucketName",
-          "documentation":"<p>The bucket on the self-managed object storage server that is used to read data from.</p>"
+          "documentation":"<p>Specifies the name of the object storage bucket involved in the transfer.</p>"
         },
         "AccessKey":{
           "shape":"ObjectStorageAccessKey",
-          "documentation":"<p>Optional. The access key is used if credentials are required to access the self-managed object storage server. If your object storage requires a user name and password to authenticate, use <code>AccessKey</code> and <code>SecretKey</code> to provide the user name and password, respectively.</p>"
+          "documentation":"<p>Specifies the access key (for example, a user name) if credentials are required to authenticate with the object storage server.</p>"
         },
         "SecretKey":{
           "shape":"ObjectStorageSecretKey",
-          "documentation":"<p>Optional. The secret key is used if credentials are required to access the self-managed object storage server. If your object storage requires a user name and password to authenticate, use <code>AccessKey</code> and <code>SecretKey</code> to provide the user name and password, respectively.</p>"
+          "documentation":"<p>Specifies the secret key (for example, a password) if credentials are required to authenticate with the object storage server.</p>"
         },
         "AgentArns":{
           "shape":"AgentArnList",
-          "documentation":"<p>The Amazon Resource Name (ARN) of the agents associated with the self-managed object storage server location.</p>"
+          "documentation":"<p>Specifies the Amazon Resource Names (ARNs) of the DataSync agents that can securely connect with your location.</p>"
         },
         "Tags":{
           "shape":"InputTagList",
-          "documentation":"<p>The key-value pair that represents the tag that you want to add to the location. The value can be an empty string. We recommend using tags to name your resources.</p>"
+          "documentation":"<p>Specifies the key-value pair that represents a tag that you want to add to the resource. Tags can help you manage, filter, and search for your resources. We recommend creating a name tag for your location.</p>"
         }
       },
       "documentation":"<p>CreateLocationObjectStorageRequest</p>"
@@ -1050,7 +1114,7 @@
       "members":{
         "LocationArn":{
           "shape":"LocationArn",
-          "documentation":"<p>The Amazon Resource Name (ARN) of the agents associated with the self-managed object storage server location.</p>"
+          "documentation":"<p>Specifies the ARN of the object storage system location that you create.</p>"
         }
       },
       "documentation":"<p>CreateLocationObjectStorageResponse</p>"
@@ -1116,7 +1180,7 @@
         },
         "User":{
           "shape":"SmbUser",
-          "documentation":"<p>The user who can mount the share, has the permissions to access files and folders in the SMB share.</p> <p>For information about choosing a user name that ensures sufficient permissions to files, folders, and metadata, see <a href=\"create-smb-location.html#SMBuser\">user</a>.</p>"
+          "documentation":"<p>The user who can mount the share, has the permissions to access files and folders in the SMB share.</p> <p>For information about choosing a user name that ensures sufficient permissions to files, folders, and metadata, see the <a href=\"create-smb-location.html#SMBuser\">User setting</a> for SMB locations.</p>"
         },
         "Domain":{
           "shape":"SmbDomain",
@@ -1337,7 +1401,7 @@
         },
         "InTransitEncryption":{
           "shape":"EfsInTransitEncryption",
-          "documentation":"<p>Whether DataSync uses TLS encryption when transferring data to or from your Amazon EFS file system.</p>"
+          "documentation":"<p>Describes whether DataSync uses Transport Layer Security (TLS) encryption when copying data to or from the Amazon EFS file system.</p>"
         }
       },
       "documentation":"<p>DescribeLocationEfsResponse</p>"
@@ -1373,6 +1437,46 @@
         }
       }
     },
+    "DescribeLocationFsxOntapRequest":{
+      "type":"structure",
+      "required":["LocationArn"],
+      "members":{
+        "LocationArn":{
+          "shape":"LocationArn",
+          "documentation":"<p>Specifies the Amazon Resource Name (ARN) of the FSx for ONTAP file system location that you want information about.</p>"
+        }
+      }
+    },
+    "DescribeLocationFsxOntapResponse":{
+      "type":"structure",
+      "members":{
+        "CreationTime":{
+          "shape":"Time",
+          "documentation":"<p>The time that the location was created.</p>"
+        },
+        "LocationArn":{
+          "shape":"LocationArn",
+          "documentation":"<p>The ARN of the FSx for ONTAP file system location.</p>"
+        },
+        "LocationUri":{
+          "shape":"LocationUri",
+          "documentation":"<p>The uniform resource identifier (URI) of the FSx for ONTAP file system location.</p>"
+        },
+        "Protocol":{"shape":"FsxProtocol"},
+        "SecurityGroupArns":{
+          "shape":"Ec2SecurityGroupArnList",
+          "documentation":"<p>The security groups that DataSync uses to access your FSx for ONTAP file system.</p>"
+        },
+        "StorageVirtualMachineArn":{
+          "shape":"StorageVirtualMachineArn",
+          "documentation":"<p>The ARN of the storage virtual machine (SVM) on your FSx for ONTAP file system where you're copying data to or from.</p>"
+        },
+        "FsxFilesystemArn":{
+          "shape":"FsxFilesystemArn",
+          "documentation":"<p>The ARN of the FSx for ONTAP file system.</p>"
+        }
+      }
+    },
     "DescribeLocationFsxOpenZfsRequest":{
       "type":"structure",
       "required":["LocationArn"],
@@ -1550,7 +1654,7 @@
       "members":{
         "LocationArn":{
           "shape":"LocationArn",
-          "documentation":"<p>The Amazon Resource Name (ARN) of the self-managed object storage server location that was described.</p>"
+          "documentation":"<p>The Amazon Resource Name (ARN) of the object storage system location that you want information about.</p>"
         }
       },
       "documentation":"<p>DescribeLocationObjectStorageRequest</p>"
@@ -1560,31 +1664,31 @@
       "members":{
         "LocationArn":{
           "shape":"LocationArn",
-          "documentation":"<p>The Amazon Resource Name (ARN) of the self-managed object storage server location to describe.</p>"
+          "documentation":"<p>The ARN of the object storage system location.</p>"
         },
         "LocationUri":{
           "shape":"LocationUri",
-          "documentation":"<p>The URL of the source self-managed object storage server location that was described.</p>"
+          "documentation":"<p>The URL of the object storage system location.</p>"
         },
         "AccessKey":{
           "shape":"ObjectStorageAccessKey",
-          "documentation":"<p>Optional. The access key is used if credentials are required to access the self-managed object storage server. If your object storage requires a user name and password to authenticate, use <code>AccessKey</code> and <code>SecretKey</code> to provide the user name and password, respectively.</p>"
+          "documentation":"<p>The access key (for example, a user name) required to authenticate with the object storage server.</p>"
         },
         "ServerPort":{
           "shape":"ObjectStorageServerPort",
-          "documentation":"<p>The port that your self-managed object storage server accepts inbound network traffic on. The server port is set by default to TCP 80 (HTTP) or TCP 443 (HTTPS).</p>"
+          "documentation":"<p>The port that your object storage server accepts inbound network traffic on (for example, port 443).</p>"
         },
         "ServerProtocol":{
           "shape":"ObjectStorageServerProtocol",
-          "documentation":"<p>The protocol that the object storage server uses to communicate. Valid values are HTTP or HTTPS.</p>"
+          "documentation":"<p>The protocol that your object storage server uses to communicate.</p>"
         },
         "AgentArns":{
           "shape":"AgentArnList",
-          "documentation":"<p>The Amazon Resource Name (ARN) of the agents associated with the self-managed object storage server location.</p>"
+          "documentation":"<p>The ARNs of the DataSync agents that can securely connect with your location.</p>"
         },
         "CreationTime":{
           "shape":"Time",
-          "documentation":"<p>The time that the self-managed object storage server agent was created.</p>"
+          "documentation":"<p>The time that the location was created.</p>"
         }
       },
       "documentation":"<p>DescribeLocationObjectStorageResponse</p>"
@@ -1944,6 +2048,11 @@
       "max":4096,
       "pattern":"^[a-zA-Z0-9_\\-\\+\\./\\(\\)\\$\\p{Zs}]+$"
     },
+    "FsxOntapSubdirectory":{
+      "type":"string",
+      "max":255,
+      "pattern":"^[^\\u0000\\u0085\\u2028\\u2029\\r\\n]{1,255}$"
+    },
     "FsxOpenZfsSubdirectory":{
       "type":"string",
       "max":4096,
@@ -1954,17 +2063,44 @@
       "members":{
         "NFS":{
           "shape":"FsxProtocolNfs",
-          "documentation":"<p>Represents the Network File System (NFS) protocol that DataSync uses to access your FSx for OpenZFS file system.</p>"
+          "documentation":"<p>Specifies the Network File System (NFS) protocol configuration that DataSync uses to access your FSx for OpenZFS file system or FSx for ONTAP file system's storage virtual machine (SVM).</p>"
+        },
+        "SMB":{
+          "shape":"FsxProtocolSmb",
+          "documentation":"<p>Specifies the Server Message Block (SMB) protocol configuration that DataSync uses to access your FSx for ONTAP file system's SVM.</p>"
         }
       },
-      "documentation":"<p>Represents the protocol that DataSync uses to access your Amazon FSx for OpenZFS file system.</p>"
+      "documentation":"<p>Specifies the data transfer protocol that DataSync uses to access your Amazon FSx file system.</p>"
     },
     "FsxProtocolNfs":{
       "type":"structure",
       "members":{
         "MountOptions":{"shape":"NfsMountOptions"}
       },
-      "documentation":"<p>Represents the Network File System (NFS) protocol that DataSync uses to access your Amazon FSx for OpenZFS file system.</p>"
+      "documentation":"<p>Specifies the Network File System (NFS) protocol configuration that DataSync uses to access your Amazon FSx for OpenZFS or Amazon FSx for NetApp ONTAP file system.</p>"
+    },
+    "FsxProtocolSmb":{
+      "type":"structure",
+      "required":[
+        "Password",
+        "User"
+      ],
+      "members":{
+        "Domain":{
+          "shape":"SmbDomain",
+          "documentation":"<p>Specifies the fully qualified domain name (FQDN) of the Microsoft Active Directory that your storage virtual machine (SVM) belongs to.</p>"
+        },
+        "MountOptions":{"shape":"SmbMountOptions"},
+        "Password":{
+          "shape":"SmbPassword",
+          "documentation":"<p>Specifies the password of a user who has permission to access your SVM.</p>"
+        },
+        "User":{
+          "shape":"SmbUser",
+          "documentation":"<p>Specifies a user who has permission to access your SVM.</p>"
+        }
+      },
+      "documentation":"<p>Specifies the Server Message Block (SMB) protocol configuration that DataSync uses to access your Amazon FSx for NetApp ONTAP file system. For more information, see <a href=\"https://docs.aws.amazon.com/datasync/latest/userguide/create-ontap-location.html#create-ontap-location-access\">Accessing FSx for ONTAP file systems</a>.</p>"
     },
     "FsxWindowsSubdirectory":{
       "type":"string",
@@ -2331,8 +2467,8 @@
     },
     "LocationUri":{
       "type":"string",
-      "max":4356,
-      "pattern":"^(efs|nfs|s3|smb|hdfs|fsx[a-z0-9]+)://[a-zA-Z0-9.:/\\-]+$"
+      "max":4360,
+      "pattern":"^(efs|nfs|s3|smb|hdfs|fsx[a-z0-9-]+)://[a-zA-Z0-9.:/\\-]+$"
     },
     "LogGroupArn":{
       "type":"string",
@@ -2374,10 +2510,10 @@
       "members":{
         "Version":{
           "shape":"NfsVersion",
-          "documentation":"<p>The specific NFS version that you want DataSync to use to mount your NFS share. If the server refuses to use the version specified, the sync will fail. If you don't specify a version, DataSync defaults to <code>AUTOMATIC</code>. That is, DataSync automatically selects a version based on negotiation with the NFS server.</p> <p>You can specify the following NFS versions:</p> <ul> <li> <p> <b> <a href=\"https://tools.ietf.org/html/rfc1813\">NFSv3</a> </b> - stateless protocol version that allows for asynchronous writes on the server.</p> </li> <li> <p> <b> <a href=\"https://tools.ietf.org/html/rfc3530\">NFSv4.0</a> </b> - stateful, firewall-friendly protocol version that supports delegations and pseudo file systems.</p> </li> <li> <p> <b> <a href=\"https://tools.ietf.org/html/rfc5661\">NFSv4.1</a> </b> - stateful protocol version that supports sessions, directory delegations, and parallel data processing. Version 4.1 also includes all features available in version 4.0.</p> </li> </ul>"
+          "documentation":"<p>Specifies the NFS version that you want DataSync to use when mounting your NFS share. If the server refuses to use the version specified, the task fails.</p> <p>You can specify the following options:</p> <ul> <li> <p> <code>AUTOMATIC</code> (default): DataSync chooses NFS version 4.1.</p> </li> <li> <p> <code>NFS3</code>: Stateless protocol version that allows for asynchronous writes on the server.</p> </li> <li> <p> <code>NFSv4_0</code>: Stateful, firewall-friendly protocol version that supports delegations and pseudo file systems.</p> </li> <li> <p> <code>NFSv4_1</code>: Stateful protocol version that supports sessions, directory delegations, and parallel data processing. NFS version 4.1 also includes all features available in version 4.0.</p> </li> </ul> <note> <p>DataSync currently only supports NFS version 3 with Amazon FSx for NetApp ONTAP locations.</p> </note>"
         }
       },
-      "documentation":"<p>Represents the mount options that are available for DataSync to access an NFS location.</p>"
+      "documentation":"<p>Specifies how DataSync can access a location using the NFS protocol.</p>"
     },
     "NfsSubdirectory":{
       "type":"string",
@@ -2463,7 +2599,7 @@
       "members":{
         "VerifyMode":{
           "shape":"VerifyMode",
-          "documentation":"<p>A value that determines whether a data integrity verification should be performed at the end of a task execution after all data and metadata have been transferred. For more information, see <a href=\"https://docs.aws.amazon.com/datasync/latest/userguide/create-task.html\">Configure task settings</a>. </p> <p>Default value: POINT_IN_TIME_CONSISTENT.</p> <p>ONLY_FILES_TRANSFERRED (recommended): Perform verification only on files that were transferred. </p> <p>POINT_IN_TIME_CONSISTENT: Scan the entire source and entire destination at the end of the transfer to verify that source and destination are fully synchronized. This option isn't supported when transferring to S3 Glacier Flexible Retrieval or S3 Glacier Deep Archive storage classes.</p> <p>NONE: No additional verification is done at the end of the transfer, but all data transmissions are integrity-checked with checksum verification during the transfer.</p>"
+          "documentation":"<p>A value that determines whether a data integrity verification should be performed at the end of a task execution after all data and metadata have been transferred. For more information, see <a href=\"https://docs.aws.amazon.com/datasync/latest/userguide/create-task.html\">Configure task settings</a>. </p> <p>Default value: <code>POINT_IN_TIME_CONSISTENT</code> </p> <p> <code>ONLY_FILES_TRANSFERRED</code> (recommended): Perform verification only on files that were transferred. </p> <p> <code>POINT_IN_TIME_CONSISTENT</code>: Scan the entire source and entire destination at the end of the transfer to verify that source and destination are fully synchronized. This option isn't supported when transferring to S3 Glacier Flexible Retrieval or S3 Glacier Deep Archive storage classes.</p> <p> <code>NONE</code>: No additional verification is done at the end of the transfer, but all data transmissions are integrity-checked with checksum verification during the transfer.</p>"
         },
         "OverwriteMode":{
           "shape":"OverwriteMode",
@@ -2471,31 +2607,31 @@
         },
         "Atime":{
           "shape":"Atime",
-          "documentation":"<p>A file metadata value that shows the last time a file was accessed (that is, when the file was read or written to). If you set <code>Atime</code> to BEST_EFFORT, DataSync attempts to preserve the original <code>Atime</code> attribute on all source files (that is, the version before the PREPARING phase). However, <code>Atime</code>'s behavior is not fully standard across platforms, so DataSync can only do this on a best-effort basis. </p> <p>Default value: BEST_EFFORT.</p> <p>BEST_EFFORT: Attempt to preserve the per-file <code>Atime</code> value (recommended).</p> <p>NONE: Ignore <code>Atime</code>.</p> <note> <p>If <code>Atime</code> is set to BEST_EFFORT, <code>Mtime</code> must be set to PRESERVE. </p> <p>If <code>Atime</code> is set to NONE, <code>Mtime</code> must also be NONE. </p> </note>"
+          "documentation":"<p>A file metadata value that shows the last time a file was accessed (that is, when the file was read or written to). If you set <code>Atime</code> to <code>BEST_EFFORT</code>, DataSync attempts to preserve the original <code>Atime</code> attribute on all source files (that is, the version before the <code>PREPARING</code> phase). However, <code>Atime</code>'s behavior is not fully standard across platforms, so DataSync can only do this on a best-effort basis. </p> <p>Default value: <code>BEST_EFFORT</code> </p> <p> <code>BEST_EFFORT</code>: Attempt to preserve the per-file <code>Atime</code> value (recommended).</p> <p> <code>NONE</code>: Ignore <code>Atime</code>.</p> <note> <p>If <code>Atime</code> is set to <code>BEST_EFFORT</code>, <code>Mtime</code> must be set to <code>PRESERVE</code>. </p> <p>If <code>Atime</code> is set to <code>NONE</code>, <code>Mtime</code> must also be <code>NONE</code>. </p> </note>"
         },
         "Mtime":{
           "shape":"Mtime",
-          "documentation":"<p>A value that indicates the last time that a file was modified (that is, a file was written to) before the PREPARING phase. This option is required for cases when you need to run the same task more than one time. </p> <p>Default Value: <code>PRESERVE</code> </p> <p>PRESERVE: Preserve original <code>Mtime</code> (recommended)</p> <p> NONE: Ignore <code>Mtime</code>. </p> <note> <p>If <code>Mtime</code> is set to PRESERVE, <code>Atime</code> must be set to BEST_EFFORT.</p> <p>If <code>Mtime</code> is set to NONE, <code>Atime</code> must also be set to NONE. </p> </note>"
+          "documentation":"<p>A value that indicates the last time that a file was modified (that is, a file was written to) before the <code>PREPARING</code> phase. This option is required for cases when you need to run the same task more than one time. </p> <p>Default Value: <code>PRESERVE</code> </p> <p> <code>PRESERVE</code>: Preserve original <code>Mtime</code> (recommended)</p> <p> <code>NONE</code>: Ignore <code>Mtime</code>. </p> <note> <p>If <code>Mtime</code> is set to <code>PRESERVE</code>, <code>Atime</code> must be set to <code>BEST_EFFORT</code>.</p> <p>If <code>Mtime</code> is set to <code>NONE</code>, <code>Atime</code> must also be set to <code>NONE</code>. </p> </note>"
         },
         "Uid":{
           "shape":"Uid",
-          "documentation":"<p>The POSIX user ID (UID) of the file's owner. This option should only be set for NFS, EFS, and S3 locations. To learn more about what metadata is copied by DataSync, see <a href=\"https://docs.aws.amazon.com/datasync/latest/userguide/special-files.html#metadata-copied\">Metadata Copied by DataSync</a>.</p> <p>Default value: INT_VALUE. This preserves the integer value of the ID.</p> <p>INT_VALUE: Preserve the integer value of UID and group ID (GID) (recommended).</p> <p>NONE: Ignore UID and GID. </p>"
+          "documentation":"<p>The POSIX user ID (UID) of the file's owner.</p> <p>For more information, see <a href=\"https://docs.aws.amazon.com/datasync/latest/userguide/special-files.html#metadata-copied\">Metadata copied by DataSync</a>.</p> <p>Default value: <code>INT_VALUE</code>. This preserves the integer value of the ID.</p> <p> <code>INT_VALUE</code>: Preserve the integer value of UID and group ID (GID) (recommended).</p> <p> <code>NONE</code>: Ignore UID and GID. </p>"
         },
         "Gid":{
           "shape":"Gid",
-          "documentation":"<p>The POSIX group ID (GID) of the file's owners. This option should only be set for NFS, EFS, and S3 locations. For more information about what metadata is copied by DataSync, see <a href=\"https://docs.aws.amazon.com/datasync/latest/userguide/special-files.html#metadata-copied\">Metadata Copied by DataSync</a>. </p> <p>Default value: INT_VALUE. This preserves the integer value of the ID.</p> <p>INT_VALUE: Preserve the integer value of user ID (UID) and GID (recommended).</p> <p>NONE: Ignore UID and GID. </p>"
+          "documentation":"<p>The POSIX group ID (GID) of the file's owners.</p> <p>For more information, see <a href=\"https://docs.aws.amazon.com/datasync/latest/userguide/special-files.html#metadata-copied\">Metadata copied by DataSync</a>.</p> <p>Default value: <code>INT_VALUE</code>. This preserves the integer value of the ID.</p> <p> <code>INT_VALUE</code>: Preserve the integer value of user ID (UID) and GID (recommended).</p> <p> <code>NONE</code>: Ignore UID and GID.</p>"
         },
         "PreserveDeletedFiles":{
           "shape":"PreserveDeletedFiles",
-          "documentation":"<p>A value that specifies whether files in the destination that don't exist in the source file system should be preserved. This option can affect your storage cost. If your task deletes objects, you might incur minimum storage duration charges for certain storage classes. For detailed information, see <a href=\"https://docs.aws.amazon.com/datasync/latest/userguide/create-s3-location.html#using-storage-classes\">Considerations when working with Amazon S3 storage classes in DataSync </a> in the <i>DataSync User Guide</i>.</p> <p>Default value: PRESERVE.</p> <p>PRESERVE: Ignore such destination files (recommended). </p> <p>REMOVE: Delete destination files that aren’t present in the source.</p>"
+          "documentation":"<p>A value that specifies whether files in the destination that don't exist in the source file system should be preserved. This option can affect your storage cost. If your task deletes objects, you might incur minimum storage duration charges for certain storage classes. For detailed information, see <a href=\"https://docs.aws.amazon.com/datasync/latest/userguide/create-s3-location.html#using-storage-classes\">Considerations when working with Amazon S3 storage classes in DataSync </a> in the <i>DataSync User Guide</i>.</p> <p>Default value: <code>PRESERVE</code> </p> <p> <code>PRESERVE</code>: Ignore such destination files (recommended). </p> <p> <code>REMOVE</code>: Delete destination files that aren’t present in the source.</p>"
         },
         "PreserveDevices":{
           "shape":"PreserveDevices",
-          "documentation":"<p>A value that determines whether DataSync should preserve the metadata of block and character devices in the source file system, and re-create the files with that device name and metadata on the destination. DataSync does not copy the contents of such devices, only the name and metadata. </p> <note> <p>DataSync can't sync the actual contents of such devices, because they are nonterminal and don't return an end-of-file (EOF) marker.</p> </note> <p>Default value: NONE.</p> <p>NONE: Ignore special devices (recommended). </p> <p>PRESERVE: Preserve character and block device metadata. This option isn't currently supported for Amazon EFS. </p>"
+          "documentation":"<p>A value that determines whether DataSync should preserve the metadata of block and character devices in the source file system, and re-create the files with that device name and metadata on the destination. DataSync does not copy the contents of such devices, only the name and metadata. </p> <note> <p>DataSync can't sync the actual contents of such devices, because they are nonterminal and don't return an end-of-file (EOF) marker.</p> </note> <p>Default value: <code>NONE</code> </p> <p> <code>NONE</code>: Ignore special devices (recommended). </p> <p> <code>PRESERVE</code>: Preserve character and block device metadata. This option isn't currently supported for Amazon EFS. </p>"
         },
         "PosixPermissions":{
           "shape":"PosixPermissions",
-          "documentation":"<p>A value that determines which users or groups can access a file for a specific purpose such as reading, writing, or execution of the file. This option should only be set for NFS, EFS, and S3 locations. For more information about what metadata is copied by DataSync, see <a href=\"https://docs.aws.amazon.com/datasync/latest/userguide/special-files.html#metadata-copied\">Metadata Copied by DataSync</a>. </p> <p>Default value: PRESERVE.</p> <p>PRESERVE: Preserve POSIX-style permissions (recommended).</p> <p>NONE: Ignore permissions. </p> <note> <p>DataSync can preserve extant permissions of a source location.</p> </note>"
+          "documentation":"<p>A value that determines which users or groups can access a file for a specific purpose such as reading, writing, or execution of the file.</p> <p>For more information, see <a href=\"https://docs.aws.amazon.com/datasync/latest/userguide/special-files.html#metadata-copied\">Metadata copied by DataSync</a>.</p> <p>Default value: <code>PRESERVE</code> </p> <p> <code>PRESERVE</code>: Preserve POSIX-style permissions (recommended).</p> <p> <code>NONE</code>: Ignore permissions. </p> <note> <p>DataSync can preserve extant permissions of a source location.</p> </note>"
         },
         "BytesPerSecond":{
           "shape":"BytesPerSecond",
@@ -2511,11 +2647,11 @@
         },
         "TransferMode":{
           "shape":"TransferMode",
-          "documentation":"<p>A value that determines whether DataSync transfers only the data and metadata that differ between the source and the destination location, or whether DataSync transfers all the content from the source, without comparing to the destination location. </p> <p>CHANGED: DataSync copies only data or metadata that is new or different content from the source location to the destination location.</p> <p>ALL: DataSync copies all source location content to the destination, without comparing to existing content on the destination.</p>"
+          "documentation":"<p>A value that determines whether DataSync transfers only the data and metadata that differ between the source and the destination location, or whether DataSync transfers all the content from the source, without comparing to the destination location. </p> <p> <code>CHANGED</code>: DataSync copies only data or metadata that is new or different content from the source location to the destination location.</p> <p> <code>ALL</code>: DataSync copies all source location content to the destination, without comparing to existing content on the destination.</p>"
         },
         "SecurityDescriptorCopyFlags":{
           "shape":"SmbSecurityDescriptorCopyFlags",
-          "documentation":"<p>A value that determines which components of the SMB security descriptor are copied from source to destination objects. </p> <p>This value is only used for transfers between SMB and Amazon FSx for Windows File Server locations, or between two Amazon FSx for Windows File Server locations. For more information about how DataSync handles metadata, see <a href=\"https://docs.aws.amazon.com/datasync/latest/userguide/special-files.html\">How DataSync Handles Metadata and Special Files</a>. </p> <p>Default value: OWNER_DACL.</p> <p> <b>OWNER_DACL</b>: For each copied object, DataSync copies the following metadata:</p> <ul> <li> <p>Object owner.</p> </li> <li> <p>NTFS discretionary access control lists (DACLs), which determine whether to grant access to an object.</p> </li> </ul> <p>When choosing this option, DataSync does NOT copy the NTFS system access control lists (SACLs), which are used by administrators to log attempts to access a secured object.</p> <p> <b>OWNER_DACL_SACL</b>: For each copied object, DataSync copies the following metadata:</p> <ul> <li> <p>Object owner.</p> </li> <li> <p>NTFS discretionary access control lists (DACLs), which determine whether to grant access to an object.</p> </li> <li> <p>NTFS system access control lists (SACLs), which are used by administrators to log attempts to access a secured object.</p> </li> </ul> <p>Copying SACLs requires granting additional permissions to the Windows user that DataSync uses to access your SMB location. For information about choosing a user that ensures sufficient permissions to files, folders, and metadata, see <a href=\"create-smb-location.html#SMBuser\">user</a>.</p> <p> <b>NONE</b>: None of the SMB security descriptor components are copied. Destination objects are owned by the user that was provided for accessing the destination location. DACLs and SACLs are set based on the destination server’s configuration. </p>"
+          "documentation":"<p>A value that determines which components of the SMB security descriptor are copied from source to destination objects. </p> <p>This value is only used for transfers between SMB and Amazon FSx for Windows File Server locations, or between two Amazon FSx for Windows File Server locations. For more information about how DataSync handles metadata, see <a href=\"https://docs.aws.amazon.com/datasync/latest/userguide/special-files.html\">How DataSync Handles Metadata and Special Files</a>. </p> <p>Default value: <code>OWNER_DACL</code> </p> <p> <code>OWNER_DACL</code>: For each copied object, DataSync copies the following metadata:</p> <ul> <li> <p>Object owner.</p> </li> <li> <p>NTFS discretionary access control lists (DACLs), which determine whether to grant access to an object.</p> </li> </ul> <p>When choosing this option, DataSync does NOT copy the NTFS system access control lists (SACLs), which are used by administrators to log attempts to access a secured object.</p> <p> <code>OWNER_DACL_SACL</code>: For each copied object, DataSync copies the following metadata:</p> <ul> <li> <p>Object owner.</p> </li> <li> <p>NTFS discretionary access control lists (DACLs), which determine whether to grant access to an object.</p> </li> <li> <p>NTFS system access control lists (SACLs), which are used by administrators to log attempts to access a secured object.</p> </li> </ul> <p>Copying SACLs requires granting additional permissions to the Windows user that DataSync uses to access your SMB location. For information about choosing a user that ensures sufficient permissions to files, folders, and metadata, see <a href=\"create-smb-location.html#SMBuser\">user</a>.</p> <p> <code>NONE</code>: None of the SMB security descriptor components are copied. Destination objects are owned by the user that was provided for accessing the destination location. DACLs and SACLs are set based on the destination server’s configuration. </p>"
         },
         "ObjectTags":{
           "shape":"ObjectTags",
@@ -2660,17 +2796,17 @@
     "SmbDomain":{
       "type":"string",
       "max":253,
-      "pattern":"^([A-Za-z0-9]+[A-Za-z0-9-.]*)*[A-Za-z0-9-]*[A-Za-z0-9]$"
+      "pattern":"^[A-Za-z0-9]((\\.|-+)?[A-Za-z0-9]){0,252}$"
     },
     "SmbMountOptions":{
       "type":"structure",
       "members":{
         "Version":{
           "shape":"SmbVersion",
-          "documentation":"<p>The specific SMB version that you want DataSync to use to mount your SMB share. If you don't specify a version, DataSync defaults to <code>AUTOMATIC</code>. That is, DataSync automatically selects a version based on negotiation with the SMB server.</p>"
+          "documentation":"<p>Specifies the SMB version that you want DataSync to use when mounting your SMB share. If you don't specify a version, DataSync defaults to <code>AUTOMATIC</code> and chooses a version based on negotiation with the SMB server.</p>"
         }
       },
-      "documentation":"<p>Represents the mount options that are available for DataSync to access an SMB location.</p>"
+      "documentation":"<p>Specifies how DataSync can access a location using the SMB protocol.</p>"
     },
     "SmbPassword":{
       "type":"string",
@@ -2738,6 +2874,11 @@
       },
       "documentation":"<p>StartTaskExecutionResponse</p>"
     },
+    "StorageVirtualMachineArn":{
+      "type":"string",
+      "max":162,
+      "pattern":"^arn:(aws|aws-cn|aws-us-gov|aws-iso|aws-iso-b):fsx:[a-z\\-0-9]+:[0-9]{12}:storage-virtual-machine/fs-[0-9a-f]+/svm-[0-9a-f]{17,}$"
+    },
     "TagKey":{
       "type":"string",
       "max":256,
diff --git a/botocore/data/ec2/2016-11-15/service-2.json b/botocore/data/ec2/2016-11-15/service-2.json
index d81a00da8..86030c877 100644
--- a/botocore/data/ec2/2016-11-15/service-2.json
+++ b/botocore/data/ec2/2016-11-15/service-2.json
@@ -865,7 +865,7 @@
       },
       "input":{"shape":"CreateRouteRequest"},
       "output":{"shape":"CreateRouteResult"},
-      "documentation":"<p>Creates a route in a route table within a VPC.</p> <p>You must specify one of the following targets: internet gateway or virtual private gateway, NAT instance, NAT gateway, VPC peering connection, network interface, egress-only internet gateway, or transit gateway.</p> <p>When determining how to route traffic, we use the route with the most specific match. For example, traffic is destined for the IPv4 address <code>192.0.2.3</code>, and the route table includes the following two IPv4 routes:</p> <ul> <li> <p> <code>192.0.2.0/24</code> (goes to some target A)</p> </li> <li> <p> <code>192.0.2.0/28</code> (goes to some target B)</p> </li> </ul> <p>Both routes apply to the traffic destined for <code>192.0.2.3</code>. However, the second route in the list covers a smaller number of IP addresses and is therefore more specific, so we use that route to determine where to target the traffic.</p> <p>For more information about route tables, see <a href=\"https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Route_Tables.html\">Route tables</a> in the <i>Amazon Virtual Private Cloud User Guide</i>.</p>"
+      "documentation":"<p>Creates a route in a route table within a VPC.</p> <p>You must specify either a destination CIDR block or a prefix list ID. You must also specify exactly one of the resources from the parameter list.</p> <p>When determining how to route traffic, we use the route with the most specific match. For example, traffic is destined for the IPv4 address <code>192.0.2.3</code>, and the route table includes the following two IPv4 routes:</p> <ul> <li> <p> <code>192.0.2.0/24</code> (goes to some target A)</p> </li> <li> <p> <code>192.0.2.0/28</code> (goes to some target B)</p> </li> </ul> <p>Both routes apply to the traffic destined for <code>192.0.2.3</code>. However, the second route in the list covers a smaller number of IP addresses and is therefore more specific, so we use that route to determine where to target the traffic.</p> <p>For more information about route tables, see <a href=\"https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Route_Tables.html\">Route tables</a> in the <i>Amazon Virtual Private Cloud User Guide</i>.</p>"
     },
     "CreateRouteTable":{
       "name":"CreateRouteTable",
@@ -1044,7 +1044,7 @@
       },
       "input":{"shape":"CreateTransitGatewayPeeringAttachmentRequest"},
       "output":{"shape":"CreateTransitGatewayPeeringAttachmentResult"},
-      "documentation":"<p>Requests a transit gateway peering attachment between the specified transit gateway (requester) and a peer transit gateway (accepter). The transit gateways must be in different Regions. The peer transit gateway can be in your account or a different Amazon Web Services account.</p> <p>After you create the peering attachment, the owner of the accepter transit gateway must accept the attachment request.</p>"
+      "documentation":"<p>Requests a transit gateway peering attachment between the specified transit gateway (requester) and a peer transit gateway (accepter). The peer transit gateway can be in your account or a different Amazon Web Services account.</p> <p>After you create the peering attachment, the owner of the accepter transit gateway must accept the attachment request.</p>"
     },
     "CreateTransitGatewayPrefixListReference":{
       "name":"CreateTransitGatewayPrefixListReference",
@@ -4743,7 +4743,7 @@
         "requestUri":"/"
       },
       "input":{"shape":"ReleaseAddressRequest"},
-      "documentation":"<p>Releases the specified Elastic IP address.</p> <p>[EC2-Classic, default VPC] Releasing an Elastic IP address automatically disassociates it from any instance that it's associated with. To disassociate an Elastic IP address without releasing it, use <a>DisassociateAddress</a>.</p> <p>[Nondefault VPC] You must use <a>DisassociateAddress</a> to disassociate the Elastic IP address before you can release it. Otherwise, Amazon EC2 returns an error (<code>InvalidIPAddress.InUse</code>).</p> <p>After releasing an Elastic IP address, it is released to the IP address pool. Be sure to update your DNS records and any servers or devices that communicate with the address. If you attempt to release an Elastic IP address that you already released, you'll get an <code>AuthFailure</code> error if the address is already allocated to another Amazon Web Services account.</p> <p>[EC2-VPC] After you release an Elastic IP address for use in a VPC, you might be able to recover it. For more information, see <a>AllocateAddress</a>.</p>"
+      "documentation":"<p>Releases the specified Elastic IP address.</p> <p>[EC2-Classic, default VPC] Releasing an Elastic IP address automatically disassociates it from any instance that it's associated with. To disassociate an Elastic IP address without releasing it, use <a>DisassociateAddress</a>.</p> <p>[Nondefault VPC] You must use <a>DisassociateAddress</a> to disassociate the Elastic IP address before you can release it. Otherwise, Amazon EC2 returns an error (<code>InvalidIPAddress.InUse</code>).</p> <p>After releasing an Elastic IP address, it is released to the IP address pool. Be sure to update your DNS records and any servers or devices that communicate with the address. If you attempt to release an Elastic IP address that you already released, you'll get an <code>AuthFailure</code> error if the address is already allocated to another Amazon Web Services account.</p> <p>[EC2-VPC] After you release an Elastic IP address for use in a VPC, you might be able to recover it. For more information, see <a>AllocateAddress</a>.</p> <p>For more information, see <a href=\"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html\">Elastic IP Addresses</a> in the <i>Amazon Elastic Compute Cloud User Guide</i>.</p>"
     },
     "ReleaseHosts":{
       "name":"ReleaseHosts",
@@ -4801,7 +4801,7 @@
         "requestUri":"/"
       },
       "input":{"shape":"ReplaceRouteRequest"},
-      "documentation":"<p>Replaces an existing route within a route table in a VPC. You must provide only one of the following: internet gateway, virtual private gateway, NAT instance, NAT gateway, VPC peering connection, network interface, egress-only internet gateway, or transit gateway.</p> <p>For more information, see <a href=\"https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Route_Tables.html\">Route tables</a> in the <i>Amazon Virtual Private Cloud User Guide</i>.</p>"
+      "documentation":"<p>Replaces an existing route within a route table in a VPC.</p> <p>You must specify either a destination CIDR block or a prefix list ID. You must also specify exactly one of the resources from the parameter list, or reset the local route to its default target.</p> <p>For more information, see <a href=\"https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Route_Tables.html\">Route tables</a> in the <i>Amazon Virtual Private Cloud User Guide</i>.</p>"
     },
     "ReplaceRouteTableAssociation":{
       "name":"ReplaceRouteTableAssociation",
@@ -8522,7 +8522,7 @@
         },
         "EphemeralStorage":{
           "shape":"Boolean",
-          "documentation":"<p>Indicates whether the Capacity Reservation supports instances with temporary, block-level storage.</p>",
+          "documentation":"<p> <i>Deprecated.</i> </p>",
           "locationName":"ephemeralStorage"
         },
         "State":{
@@ -10312,7 +10312,7 @@
         },
         "EphemeralStorage":{
           "shape":"Boolean",
-          "documentation":"<p>Indicates whether the Capacity Reservation supports instances with temporary, block-level storage.</p>"
+          "documentation":"<p> <i>Deprecated.</i> </p>"
         },
         "EndDate":{
           "shape":"DateTime",
@@ -11378,7 +11378,7 @@
         },
         "TagSpecifications":{
           "shape":"TagSpecificationList",
-          "documentation":"<p>The tags to apply to the launch template during creation.</p>",
+          "documentation":"<p>The tags to apply to the launch template on creation. To tag the launch template, the resource type must be <code>launch-template</code>.</p> <note> <p>To specify the tags for the resources that are created when an instance is launched, you must use the <code>TagSpecifications</code> parameter in the <a href=\"https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RequestLaunchTemplateData.html\">launch template data</a> structure.</p> </note>",
           "locationName":"TagSpecification"
         }
       }
@@ -11981,6 +11981,10 @@
           "shape":"TagSpecificationList",
           "documentation":"<p>The tags to apply to the new placement group.</p>",
           "locationName":"TagSpecification"
+        },
+        "SpreadLevel":{
+          "shape":"SpreadLevel",
+          "documentation":"<p>Determines how placement groups spread instances. </p> <ul> <li> <p>Host – You can use <code>host</code> only with Outpost placement groups.</p> </li> <li> <p>Rack – No usage restrictions.</p> </li> </ul>"
         }
       }
     },
@@ -18646,7 +18650,7 @@
       "members":{
         "Filters":{
           "shape":"FilterList",
-          "documentation":"<p>One or more filters.</p> <ul> <li> <p> <code>association.association-id</code> - The ID of an association ID for the ACL.</p> </li> <li> <p> <code>association.network-acl-id</code> - The ID of the network ACL involved in the association.</p> </li> <li> <p> <code>association.subnet-id</code> - The ID of the subnet involved in the association.</p> </li> <li> <p> <code>default</code> - Indicates whether the ACL is the default network ACL for the VPC.</p> </li> <li> <p> <code>entry.cidr</code> - The IPv4 CIDR range specified in the entry.</p> </li> <li> <p> <code>entry.icmp.code</code> - The ICMP code specified in the entry, if any.</p> </li> <li> <p> <code>entry.icmp.type</code> - The ICMP type specified in the entry, if any.</p> </li> <li> <p> <code>entry.ipv6-cidr</code> - The IPv6 CIDR range specified in the entry.</p> </li> <li> <p> <code>entry.port-range.from</code> - The start of the port range specified in the entry. </p> </li> <li> <p> <code>entry.port-range.to</code> - The end of the port range specified in the entry. </p> </li> <li> <p> <code>entry.protocol</code> - The protocol specified in the entry (<code>tcp</code> | <code>udp</code> | <code>icmp</code> or a protocol number).</p> </li> <li> <p> <code>entry.rule-action</code> - Allows or denies the matching traffic (<code>allow</code> | <code>deny</code>).</p> </li> <li> <p> <code>entry.rule-number</code> - The number of an entry (in other words, rule) in the set of ACL entries.</p> </li> <li> <p> <code>network-acl-id</code> - The ID of the network ACL.</p> </li> <li> <p> <code>owner-id</code> - The ID of the Amazon Web Services account that owns the network ACL.</p> </li> <li> <p> <code>tag</code>:&lt;key&gt; - The key/value combination of a tag assigned to the resource. Use the tag key in the filter name and the tag value as the filter value. For example, to find all resources that have a tag with the key <code>Owner</code> and the value <code>TeamA</code>, specify <code>tag:Owner</code> for the filter name and <code>TeamA</code> for the filter value.</p> </li> <li> <p> <code>tag-key</code> - The key of a tag assigned to the resource. Use this filter to find all resources assigned a tag with a specific key, regardless of the tag value.</p> </li> <li> <p> <code>vpc-id</code> - The ID of the VPC for the network ACL.</p> </li> </ul>",
+          "documentation":"<p>One or more filters.</p> <ul> <li> <p> <code>association.association-id</code> - The ID of an association ID for the ACL.</p> </li> <li> <p> <code>association.network-acl-id</code> - The ID of the network ACL involved in the association.</p> </li> <li> <p> <code>association.subnet-id</code> - The ID of the subnet involved in the association.</p> </li> <li> <p> <code>default</code> - Indicates whether the ACL is the default network ACL for the VPC.</p> </li> <li> <p> <code>entry.cidr</code> - The IPv4 CIDR range specified in the entry.</p> </li> <li> <p> <code>entry.icmp.code</code> - The ICMP code specified in the entry, if any.</p> </li> <li> <p> <code>entry.icmp.type</code> - The ICMP type specified in the entry, if any.</p> </li> <li> <p> <code>entry.ipv6-cidr</code> - The IPv6 CIDR range specified in the entry.</p> </li> <li> <p> <code>entry.port-range.from</code> - The start of the port range specified in the entry. </p> </li> <li> <p> <code>entry.port-range.to</code> - The end of the port range specified in the entry. </p> </li> <li> <p> <code>entry.protocol</code> - The protocol specified in the entry (<code>tcp</code> | <code>udp</code> | <code>icmp</code> or a protocol number).</p> </li> <li> <p> <code>entry.rule-action</code> - Allows or denies the matching traffic (<code>allow</code> | <code>deny</code>).</p> </li> <li> <p> <code>entry.egress</code> - A Boolean that indicates the type of rule. Specify <code>true</code> for egress rules, or <code>false</code> for ingress rules.</p> </li> <li> <p> <code>entry.rule-number</code> - The number of an entry (in other words, rule) in the set of ACL entries.</p> </li> <li> <p> <code>network-acl-id</code> - The ID of the network ACL.</p> </li> <li> <p> <code>owner-id</code> - The ID of the Amazon Web Services account that owns the network ACL.</p> </li> <li> <p> <code>tag</code>:&lt;key&gt; - The key/value combination of a tag assigned to the resource. Use the tag key in the filter name and the tag value as the filter value. For example, to find all resources that have a tag with the key <code>Owner</code> and the value <code>TeamA</code>, specify <code>tag:Owner</code> for the filter name and <code>TeamA</code> for the filter value.</p> </li> <li> <p> <code>tag-key</code> - The key of a tag assigned to the resource. Use this filter to find all resources assigned a tag with a specific key, regardless of the tag value.</p> </li> <li> <p> <code>vpc-id</code> - The ID of the VPC for the network ACL.</p> </li> </ul>",
           "locationName":"Filter"
         },
         "DryRun":{
@@ -19029,7 +19033,7 @@
       "members":{
         "Filters":{
           "shape":"FilterList",
-          "documentation":"<p>The filters.</p> <ul> <li> <p> <code>group-name</code> - The name of the placement group.</p> </li> <li> <p> <code>group-arn</code> - The Amazon Resource Name (ARN) of the placement group.</p> </li> <li> <p> <code>state</code> - The state of the placement group (<code>pending</code> | <code>available</code> | <code>deleting</code> | <code>deleted</code>).</p> </li> <li> <p> <code>strategy</code> - The strategy of the placement group (<code>cluster</code> | <code>spread</code> | <code>partition</code>).</p> </li> <li> <p> <code>tag:&lt;key&gt;</code> - The key/value combination of a tag assigned to the resource. Use the tag key in the filter name and the tag value as the filter value. For example, to find all resources that have a tag with the key <code>Owner</code> and the value <code>TeamA</code>, specify <code>tag:Owner</code> for the filter name and <code>TeamA</code> for the filter value.</p> </li> <li> <p> <code>tag-key</code> - The key of a tag assigned to the resource. Use this filter to find all resources that have a tag with a specific key, regardless of the tag value.</p> </li> </ul>",
+          "documentation":"<p>The filters.</p> <ul> <li> <p> <code>group-name</code> - The name of the placement group.</p> </li> <li> <p> <code>group-arn</code> - The Amazon Resource Name (ARN) of the placement group.</p> </li> <li> <p> <code>spread-level</code> - The spread level for the placement group (<code>host</code> | <code>rack</code>). </p> </li> <li> <p> <code>state</code> - The state of the placement group (<code>pending</code> | <code>available</code> | <code>deleting</code> | <code>deleted</code>).</p> </li> <li> <p> <code>strategy</code> - The strategy of the placement group (<code>cluster</code> | <code>spread</code> | <code>partition</code>).</p> </li> <li> <p> <code>tag:&lt;key&gt;</code> - The key/value combination of a tag assigned to the resource. Use the tag key in the filter name and the tag value as the filter value. For example, to find all resources that have a tag with the key <code>Owner</code> and the value <code>TeamA</code>, specify <code>tag:Owner</code> for the filter name and <code>TeamA</code> for the filter value.</p> </li> <li> <p> <code>tag-key</code> - The key of a tag assigned to the resource. Use this filter to find all resources that have a tag with a specific key, regardless of the tag value.</p> </li> </ul>",
           "locationName":"Filter"
         },
         "DryRun":{
@@ -23769,7 +23773,7 @@
         },
         "EventSubType":{
           "shape":"String",
-          "documentation":"<p>The event.</p> <p> <code>error</code> events:</p> <ul> <li> <p> <code>iamFleetRoleInvalid</code> - The EC2 Fleet or Spot Fleet does not have the required permissions either to launch or terminate an instance.</p> </li> <li> <p> <code>allLaunchSpecsTemporarilyBlacklisted</code> - None of the configurations are valid, and several attempts to launch instances have failed. For more information, see the description of the event.</p> </li> <li> <p> <code>spotInstanceCountLimitExceeded</code> - You've reached the limit on the number of Spot Instances that you can launch.</p> </li> <li> <p> <code>spotFleetRequestConfigurationInvalid</code> - The configuration is not valid. For more information, see the description of the event.</p> </li> </ul> <p> <code>fleetRequestChange</code> events:</p> <ul> <li> <p> <code>active</code> - The EC2 Fleet or Spot Fleet request has been validated and Amazon EC2 is attempting to maintain the target number of running instances.</p> </li> <li> <p> <code>cancelled</code> - The EC2 Fleet or Spot Fleet request is canceled and has no running instances. The EC2 Fleet or Spot Fleet will be deleted two days after its instances are terminated.</p> </li> <li> <p> <code>cancelled_running</code> - The EC2 Fleet or Spot Fleet request is canceled and does not launch additional instances. Its existing instances continue to run until they are interrupted or terminated. The request remains in this state until all instances are interrupted or terminated.</p> </li> <li> <p> <code>cancelled_terminating</code> - The EC2 Fleet or Spot Fleet request is canceled and its instances are terminating. The request remains in this state until all instances are terminated.</p> </li> <li> <p> <code>expired</code> - The EC2 Fleet or Spot Fleet request has expired. If the request was created with <code>TerminateInstancesWithExpiration</code> set, a subsequent <code>terminated</code> event indicates that the instances are terminated.</p> </li> <li> <p> <code>modify_in_progress</code> - The EC2 Fleet or Spot Fleet request is being modified. The request remains in this state until the modification is fully processed.</p> </li> <li> <p> <code>modify_succeeded</code> - The EC2 Fleet or Spot Fleet request was modified.</p> </li> <li> <p> <code>submitted</code> - The EC2 Fleet or Spot Fleet request is being evaluated and Amazon EC2 is preparing to launch the target number of instances.</p> </li> <li> <p> <code>progress</code> - The EC2 Fleet or Spot Fleet request is in the process of being fulfilled.</p> </li> </ul> <p> <code>instanceChange</code> events:</p> <ul> <li> <p> <code>launched</code> - A new instance was launched.</p> </li> <li> <p> <code>terminated</code> - An instance was terminated by the user.</p> </li> <li> <p> <code>termination_notified</code> - An instance termination notification was sent when a Spot Instance was terminated by Amazon EC2 during scale-down, when the target capacity of the fleet was modified down, for example, from a target capacity of 4 to a target capacity of 3.</p> </li> </ul> <p> <code>Information</code> events:</p> <ul> <li> <p> <code>fleetProgressHalted</code> - The price in every launch specification is not valid because it is below the Spot price (all the launch specifications have produced <code>launchSpecUnusable</code> events). A launch specification might become valid if the Spot price changes.</p> </li> <li> <p> <code>launchSpecTemporarilyBlacklisted</code> - The configuration is not valid and several attempts to launch instances have failed. For more information, see the description of the event.</p> </li> <li> <p> <code>launchSpecUnusable</code> - The price in a launch specification is not valid because it is below the Spot price.</p> </li> <li> <p> <code>registerWithLoadBalancersFailed</code> - An attempt to register instances with load balancers failed. For more information, see the description of the event.</p> </li> </ul>",
+          "documentation":"<p>The event.</p> <p> <code>error</code> events:</p> <ul> <li> <p> <code>iamFleetRoleInvalid</code> - The EC2 Fleet or Spot Fleet does not have the required permissions either to launch or terminate an instance.</p> </li> <li> <p> <code>allLaunchSpecsTemporarilyBlacklisted</code> - None of the configurations are valid, and several attempts to launch instances have failed. For more information, see the description of the event.</p> </li> <li> <p> <code>spotInstanceCountLimitExceeded</code> - You've reached the limit on the number of Spot Instances that you can launch.</p> </li> <li> <p> <code>spotFleetRequestConfigurationInvalid</code> - The configuration is not valid. For more information, see the description of the event.</p> </li> </ul> <p> <code>fleetRequestChange</code> events:</p> <ul> <li> <p> <code>active</code> - The EC2 Fleet or Spot Fleet request has been validated and Amazon EC2 is attempting to maintain the target number of running instances.</p> </li> <li> <p> <code>deleted</code> (EC2 Fleet) / <code>cancelled</code> (Spot Fleet) - The EC2 Fleet is deleted or the Spot Fleet request is canceled and has no running instances. The EC2 Fleet or Spot Fleet will be deleted two days after its instances are terminated.</p> </li> <li> <p> <code>deleted_running</code> (EC2 Fleet) / <code>cancelled_running</code> (Spot Fleet) - The EC2 Fleet is deleted or the Spot Fleet request is canceled and does not launch additional instances. Its existing instances continue to run until they are interrupted or terminated. The request remains in this state until all instances are interrupted or terminated.</p> </li> <li> <p> <code>deleted_terminating</code> (EC2 Fleet) / <code>cancelled_terminating</code> (Spot Fleet) - The EC2 Fleet is deleted or the Spot Fleet request is canceled and its instances are terminating. The request remains in this state until all instances are terminated.</p> </li> <li> <p> <code>expired</code> - The EC2 Fleet or Spot Fleet request has expired. If the request was created with <code>TerminateInstancesWithExpiration</code> set, a subsequent <code>terminated</code> event indicates that the instances are terminated.</p> </li> <li> <p> <code>modify_in_progress</code> - The EC2 Fleet or Spot Fleet request is being modified. The request remains in this state until the modification is fully processed.</p> </li> <li> <p> <code>modify_succeeded</code> - The EC2 Fleet or Spot Fleet request was modified.</p> </li> <li> <p> <code>submitted</code> - The EC2 Fleet or Spot Fleet request is being evaluated and Amazon EC2 is preparing to launch the target number of instances.</p> </li> <li> <p> <code>progress</code> - The EC2 Fleet or Spot Fleet request is in the process of being fulfilled.</p> </li> </ul> <p> <code>instanceChange</code> events:</p> <ul> <li> <p> <code>launched</code> - A new instance was launched.</p> </li> <li> <p> <code>terminated</code> - An instance was terminated by the user.</p> </li> <li> <p> <code>termination_notified</code> - An instance termination notification was sent when a Spot Instance was terminated by Amazon EC2 during scale-down, when the target capacity of the fleet was modified down, for example, from a target capacity of 4 to a target capacity of 3.</p> </li> </ul> <p> <code>Information</code> events:</p> <ul> <li> <p> <code>fleetProgressHalted</code> - The price in every launch specification is not valid because it is below the Spot price (all the launch specifications have produced <code>launchSpecUnusable</code> events). A launch specification might become valid if the Spot price changes.</p> </li> <li> <p> <code>launchSpecTemporarilyBlacklisted</code> - The configuration is not valid and several attempts to launch instances have failed. For more information, see the description of the event.</p> </li> <li> <p> <code>launchSpecUnusable</code> - The price in a launch specification is not valid because it is below the Spot price.</p> </li> <li> <p> <code>registerWithLoadBalancersFailed</code> - An attempt to register instances with load balancers failed. For more information, see the description of the event.</p> </li> </ul>",
           "locationName":"eventSubType"
         },
         "InstanceId":{
@@ -30249,7 +30253,7 @@
         },
         "LocalStorageTypes":{
           "shape":"LocalStorageTypeSet",
-          "documentation":"<p>The type of local storage that is required.</p> <ul> <li> <p>For instance types with hard disk drive (HDD) storage, specify <code>hdd</code>.</p> </li> <li> <p>For instance types with solid state drive (SDD) storage, specify <code>sdd</code>.</p> </li> </ul> <p>Default: <code>hdd</code> and <code>sdd</code> </p>",
+          "documentation":"<p>The type of local storage that is required.</p> <ul> <li> <p>For instance types with hard disk drive (HDD) storage, specify <code>hdd</code>.</p> </li> <li> <p>For instance types with solid state drive (SSD) storage, specify <code>ssd</code>.</p> </li> </ul> <p>Default: <code>hdd</code> and <code>ssd</code> </p>",
           "locationName":"localStorageTypeSet"
         },
         "TotalLocalStorageGB":{
@@ -30354,7 +30358,7 @@
         },
         "LocalStorageTypes":{
           "shape":"LocalStorageTypeSet",
-          "documentation":"<p>The type of local storage that is required.</p> <ul> <li> <p>For instance types with hard disk drive (HDD) storage, specify <code>hdd</code>.</p> </li> <li> <p>For instance types with solid state drive (SDD) storage, specify <code>sdd</code>.</p> </li> </ul> <p>Default: <code>hdd</code> and <code>sdd</code> </p>",
+          "documentation":"<p>The type of local storage that is required.</p> <ul> <li> <p>For instance types with hard disk drive (HDD) storage, specify <code>hdd</code>.</p> </li> <li> <p>For instance types with solid state drive (SSD) storage, specify <code>ssd</code>.</p> </li> </ul> <p>Default: <code>hdd</code> and <code>ssd</code> </p>",
           "locationName":"LocalStorageType"
         },
         "TotalLocalStorageGB":{
@@ -33924,7 +33928,7 @@
       "members":{
         "ResourceType":{
           "shape":"ResourceType",
-          "documentation":"<p>The type of resource.</p>",
+          "documentation":"<p>The type of resource to tag.</p>",
           "locationName":"resourceType"
         },
         "Tags":{
@@ -33933,7 +33937,7 @@
           "locationName":"tagSet"
         }
       },
-      "documentation":"<p>The tag specification for the launch template.</p>"
+      "documentation":"<p>The tags specification for the launch template.</p>"
     },
     "LaunchTemplateTagSpecificationList":{
       "type":"list",
@@ -33947,7 +33951,7 @@
       "members":{
         "ResourceType":{
           "shape":"ResourceType",
-          "documentation":"<p>The type of resource to tag. Currently, the resource types that support tagging on creation are <code>instance</code>, <code>volume</code>, <code>elastic-gpu</code>, <code>network-interface</code>, and <code>spot-instances-request</code>. To tag a resource after it has been created, see <a href=\"https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateTags.html\">CreateTags</a>.</p>"
+          "documentation":"<p>The type of resource to tag.</p> <p>The <code>Valid Values</code> are all the resource types that can be tagged. However, when creating a launch template, you can specify tags for the following resource types only: <code>instance</code> | <code>volume</code> | <code>elastic-gpu</code> | <code>network-interface</code> | <code>spot-instances-request</code> </p> <p>To tag a resource after it has been created, see <a href=\"https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateTags.html\">CreateTags</a>.</p>"
         },
         "Tags":{
           "shape":"TagList",
@@ -33955,7 +33959,7 @@
           "locationName":"Tag"
         }
       },
-      "documentation":"<p>The tags specification for the launch template.</p>"
+      "documentation":"<p>The tags specification for the resources that are created during instance launch.</p>"
     },
     "LaunchTemplateTagSpecificationRequestList":{
       "type":"list",
@@ -38814,6 +38818,7 @@
         },
         "TransitGateway":{
           "shape":"AnalysisComponent",
+          "documentation":"<p>The transit gateway.</p>",
           "locationName":"transitGateway"
         },
         "TransitGatewayRouteTableRoute":{
@@ -39268,6 +39273,11 @@
           "shape":"String",
           "documentation":"<p>The Amazon Resource Name (ARN) of the placement group.</p>",
           "locationName":"groupArn"
+        },
+        "SpreadLevel":{
+          "shape":"SpreadLevel",
+          "documentation":"<p> The spread level for the placement group. <i>Only</i> Outpost placement groups can be spread across hosts. </p>",
+          "locationName":"spreadLevel"
         }
       },
       "documentation":"<p>Describes a placement group.</p>"
@@ -41486,7 +41496,7 @@
         },
         "TagSpecifications":{
           "shape":"LaunchTemplateTagSpecificationRequestList",
-          "documentation":"<p>The tags to apply to the resources during launch. You can only tag instances and volumes on launch. The specified tags are applied to all instances or volumes that are created during launch. To tag a resource after it has been created, see <a href=\"https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateTags.html\">CreateTags</a>.</p>",
+          "documentation":"<p>The tags to apply to the resources that are created during instance launch.</p> <p>You can specify tags for the following resources only:</p> <ul> <li> <p>Instances</p> </li> <li> <p>Volumes</p> </li> <li> <p>Elastic graphics</p> </li> <li> <p>Spot Instance requests</p> </li> <li> <p>Network interfaces</p> </li> </ul> <p>To tag a resource after it has been created, see <a href=\"https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateTags.html\">CreateTags</a>.</p> <note> <p>To tag the launch template itself, you must use the <a href=\"https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateLaunchTemplate.html\">TagSpecification</a> parameter.</p> </note>",
           "locationName":"TagSpecification"
         },
         "ElasticGpuSpecifications":{
@@ -41515,7 +41525,7 @@
         },
         "CreditSpecification":{
           "shape":"CreditSpecificationRequest",
-          "documentation":"<p>The credit option for CPU usage of the instance. Valid for T2, T3, or T3a instances only.</p>"
+          "documentation":"<p>The credit option for CPU usage of the instance. Valid only for T instances.</p>"
         },
         "CpuOptions":{
           "shape":"LaunchTemplateCpuOptionsRequest",
@@ -42748,7 +42758,7 @@
         },
         "TagSpecifications":{
           "shape":"LaunchTemplateTagSpecificationList",
-          "documentation":"<p>The tags.</p>",
+          "documentation":"<p>The tags that are applied to the resources that are created during instance launch.</p>",
           "locationName":"tagSpecificationSet"
         },
         "ElasticGpuSpecifications":{
@@ -46180,6 +46190,13 @@
         "locationName":"item"
       }
     },
+    "SpreadLevel":{
+      "type":"string",
+      "enum":[
+        "host",
+        "rack"
+      ]
+    },
     "StaleIpPermission":{
       "type":"structure",
       "members":{
diff --git a/botocore/data/finspace-data/2020-07-13/service-2.json b/botocore/data/finspace-data/2020-07-13/service-2.json
index 755f78911..e537e5865 100644
--- a/botocore/data/finspace-data/2020-07-13/service-2.json
+++ b/botocore/data/finspace-data/2020-07-13/service-2.json
@@ -269,6 +269,23 @@
       ],
       "documentation":"<p>Returns information about a Dataset.</p>"
     },
+    "GetExternalDataViewAccessDetails":{
+      "name":"GetExternalDataViewAccessDetails",
+      "http":{
+        "method":"POST",
+        "requestUri":"/datasets/{datasetId}/dataviewsv2/{dataviewId}/external-access-details"
+      },
+      "input":{"shape":"GetExternalDataViewAccessDetailsRequest"},
+      "output":{"shape":"GetExternalDataViewAccessDetailsResponse"},
+      "errors":[
+        {"shape":"ResourceNotFoundException"},
+        {"shape":"InternalServerException"},
+        {"shape":"ThrottlingException"},
+        {"shape":"ValidationException"},
+        {"shape":"AccessDeniedException"}
+      ],
+      "documentation":"<p>Returns the credentials to access the external Dataview from an S3 location. To call this API:</p> <ul> <li> <p>You must retrieve the programmatic credentials.</p> </li> <li> <p>You must be a member of a FinSpace user group, where the dataset that you want to access has <code>Read Dataset Data</code> permissions.</p> </li> </ul>"
+    },
     "GetPermissionGroup":{
       "name":"GetPermissionGroup",
       "http":{
@@ -554,6 +571,12 @@
       "error":{"httpStatusCode":403},
       "exception":true
     },
+    "AccessKeyId":{
+      "type":"string",
+      "max":255,
+      "min":1,
+      "pattern":"[\\s\\S]*\\S[\\s\\S]*"
+    },
     "AliasString":{
       "type":"string",
       "max":255,
@@ -619,6 +642,28 @@
         }
       }
     },
+    "AwsCredentials":{
+      "type":"structure",
+      "members":{
+        "accessKeyId":{
+          "shape":"AccessKeyId",
+          "documentation":"<p> The unique identifier for the security credentials.</p>"
+        },
+        "secretAccessKey":{
+          "shape":"SecretAccessKey",
+          "documentation":"<p> The secret access key that can be used to sign requests.</p>"
+        },
+        "sessionToken":{
+          "shape":"SessionToken",
+          "documentation":"<p> The token that users must pass to use the credentials.</p>"
+        },
+        "expiration":{
+          "shape":"TimestampEpoch",
+          "documentation":"<p> The Epoch time when the current credentials expire.</p>"
+        }
+      },
+      "documentation":"<p> The credentials required to access the external Dataview from the S3 location.</p>"
+    },
     "Boolean":{
       "type":"boolean",
       "documentation":"Common Boolean data type"
@@ -972,7 +1017,7 @@
         },
         "applicationPermissions":{
           "shape":"ApplicationPermissionList",
-          "documentation":"<p>The option to indicate FinSpace application permissions that are granted to a specific group.</p> <ul> <li> <p> <code>CreateDataset</code> – Group members can create new datasets.</p> </li> <li> <p> <code>ManageClusters</code> – Group members can manage Apache Spark clusters from FinSpace notebooks.</p> </li> <li> <p> <code>ManageUsersAndGroups</code> – Group members can manage users and permission groups.</p> </li> <li> <p> <code>ManageAttributeSets</code> – Group members can manage attribute sets.</p> </li> <li> <p> <code>ViewAuditData</code> – Group members can view audit data.</p> </li> <li> <p> <code>AccessNotebooks</code> – Group members will have access to FinSpace notebooks.</p> </li> <li> <p> <code>GetTemporaryCredentials</code> – Group members can get temporary API credentials.</p> </li> </ul>"
+          "documentation":"<p>The option to indicate FinSpace application permissions that are granted to a specific group.</p> <important> <p>When assigning application permissions, be aware that the permission <code>ManageUsersAndGroups</code> allows users to grant themselves or others access to any functionality in their FinSpace environment's application. It should only be granted to trusted users.</p> </important> <ul> <li> <p> <code>CreateDataset</code> – Group members can create new datasets.</p> </li> <li> <p> <code>ManageClusters</code> – Group members can manage Apache Spark clusters from FinSpace notebooks.</p> </li> <li> <p> <code>ManageUsersAndGroups</code> – Group members can manage users and permission groups. This is a privileged permission that allows users to grant themselves or others access to any functionality in the application. It should only be granted to trusted users.</p> </li> <li> <p> <code>ManageAttributeSets</code> – Group members can manage attribute sets.</p> </li> <li> <p> <code>ViewAuditData</code> – Group members can view audit data.</p> </li> <li> <p> <code>AccessNotebooks</code> – Group members will have access to FinSpace notebooks.</p> </li> <li> <p> <code>GetTemporaryCredentials</code> – Group members can get temporary API credentials.</p> </li> </ul>"
         },
         "clientToken":{
           "shape":"ClientToken",
@@ -1699,6 +1744,40 @@
       },
       "documentation":"Response for the GetDataset operation"
     },
+    "GetExternalDataViewAccessDetailsRequest":{
+      "type":"structure",
+      "required":[
+        "dataViewId",
+        "datasetId"
+      ],
+      "members":{
+        "dataViewId":{
+          "shape":"DataViewId",
+          "documentation":"<p>The unique identifier for the Dataview that you want to access.</p>",
+          "location":"uri",
+          "locationName":"dataviewId"
+        },
+        "datasetId":{
+          "shape":"DatasetId",
+          "documentation":"<p>The unique identifier for the Dataset.</p>",
+          "location":"uri",
+          "locationName":"datasetId"
+        }
+      }
+    },
+    "GetExternalDataViewAccessDetailsResponse":{
+      "type":"structure",
+      "members":{
+        "credentials":{
+          "shape":"AwsCredentials",
+          "documentation":"<p>The credentials required to access the external Dataview from the S3 location.</p>"
+        },
+        "s3Location":{
+          "shape":"S3Location",
+          "documentation":"<p>The location where the external Dataview is stored.</p>"
+        }
+      }
+    },
     "GetPermissionGroupRequest":{
       "type":"structure",
       "required":["permissionGroupId"],
@@ -2177,7 +2256,7 @@
         },
         "applicationPermissions":{
           "shape":"ApplicationPermissionList",
-          "documentation":"<p>Indicates the permissions that are granted to a specific group for accessing the FinSpace application.</p> <ul> <li> <p> <code>CreateDataset</code> – Group members can create new datasets.</p> </li> <li> <p> <code>ManageClusters</code> – Group members can manage Apache Spark clusters from FinSpace notebooks.</p> </li> <li> <p> <code>ManageUsersAndGroups</code> – Group members can manage users and permission groups.</p> </li> <li> <p> <code>ManageAttributeSets</code> – Group members can manage attribute sets.</p> </li> <li> <p> <code>ViewAuditData</code> – Group members can view audit data.</p> </li> <li> <p> <code>AccessNotebooks</code> – Group members will have access to FinSpace notebooks.</p> </li> <li> <p> <code>GetTemporaryCredentials</code> – Group members can get temporary API credentials.</p> </li> </ul>"
+          "documentation":"<p>Indicates the permissions that are granted to a specific group for accessing the FinSpace application.</p> <important> <p>When assigning application permissions, be aware that the permission <code>ManageUsersAndGroups</code> allows users to grant themselves or others access to any functionality in their FinSpace environment's application. It should only be granted to trusted users.</p> </important> <ul> <li> <p> <code>CreateDataset</code> – Group members can create new datasets.</p> </li> <li> <p> <code>ManageClusters</code> – Group members can manage Apache Spark clusters from FinSpace notebooks.</p> </li> <li> <p> <code>ManageUsersAndGroups</code> – Group members can manage users and permission groups. This is a privileged permission that allows users to grant themselves or others access to any functionality in the application. It should only be granted to trusted users.</p> </li> <li> <p> <code>ManageAttributeSets</code> – Group members can manage attribute sets.</p> </li> <li> <p> <code>ViewAuditData</code> – Group members can view audit data.</p> </li> <li> <p> <code>AccessNotebooks</code> – Group members will have access to FinSpace notebooks.</p> </li> <li> <p> <code>GetTemporaryCredentials</code> – Group members can get temporary API credentials.</p> </li> </ul>"
         },
         "createTime":{
           "shape":"TimestampEpoch",
@@ -2335,11 +2414,41 @@
       "min":20,
       "pattern":"^arn:aws[a-z\\-]*:iam::\\d{12}:role/?[a-zA-Z_0-9+=,.@\\-_/]+$"
     },
+    "S3BucketName":{
+      "type":"string",
+      "max":63,
+      "min":1,
+      "pattern":"^.*\\S.*$"
+    },
     "S3DestinationFormatOptions":{
       "type":"map",
       "key":{"shape":"StringMapKey"},
       "value":{"shape":"StringMapValue"}
     },
+    "S3Key":{
+      "type":"string",
+      "max":1024,
+      "min":1,
+      "pattern":"^.*\\S.*$"
+    },
+    "S3Location":{
+      "type":"structure",
+      "required":[
+        "bucket",
+        "key"
+      ],
+      "members":{
+        "bucket":{
+          "shape":"S3BucketName",
+          "documentation":"<p> The name of the S3 bucket.</p>"
+        },
+        "key":{
+          "shape":"S3Key",
+          "documentation":"<p> The path of the folder, within the S3 bucket that contains the Dataset.</p>"
+        }
+      },
+      "documentation":"<p>The location of an external Dataview in an S3 bucket.</p>"
+    },
     "SchemaDefinition":{
       "type":"structure",
       "members":{
@@ -2364,11 +2473,25 @@
       },
       "documentation":"<p>A union of schema types.</p>"
     },
+    "SecretAccessKey":{
+      "type":"string",
+      "max":1000,
+      "min":1,
+      "pattern":"[\\s\\S]*\\S[\\s\\S]*",
+      "sensitive":true
+    },
     "SessionDuration":{
       "type":"long",
       "max":720,
       "min":60
     },
+    "SessionToken":{
+      "type":"string",
+      "max":1000,
+      "min":1,
+      "pattern":"[\\s\\S]*\\S[\\s\\S]*",
+      "sensitive":true
+    },
     "SortColumnList":{
       "type":"list",
       "member":{"shape":"StringValueLength1to255"},
@@ -2540,7 +2663,7 @@
         },
         "applicationPermissions":{
           "shape":"ApplicationPermissionList",
-          "documentation":"<p>The permissions that are granted to a specific group for accessing the FinSpace application.</p> <ul> <li> <p> <code>CreateDataset</code> – Group members can create new datasets.</p> </li> <li> <p> <code>ManageClusters</code> – Group members can manage Apache Spark clusters from FinSpace notebooks.</p> </li> <li> <p> <code>ManageUsersAndGroups</code> – Group members can manage users and permission groups.</p> </li> <li> <p> <code>ManageAttributeSets</code> – Group members can manage attribute sets.</p> </li> <li> <p> <code>ViewAuditData</code> – Group members can view audit data.</p> </li> <li> <p> <code>AccessNotebooks</code> – Group members will have access to FinSpace notebooks.</p> </li> <li> <p> <code>GetTemporaryCredentials</code> – Group members can get temporary API credentials.</p> </li> </ul>"
+          "documentation":"<p>The permissions that are granted to a specific group for accessing the FinSpace application.</p> <important> <p>When assigning application permissions, be aware that the permission <code>ManageUsersAndGroups</code> allows users to grant themselves or others access to any functionality in their FinSpace environment's application. It should only be granted to trusted users.</p> </important> <ul> <li> <p> <code>CreateDataset</code> – Group members can create new datasets.</p> </li> <li> <p> <code>ManageClusters</code> – Group members can manage Apache Spark clusters from FinSpace notebooks.</p> </li> <li> <p> <code>ManageUsersAndGroups</code> – Group members can manage users and permission groups. This is a privileged permission that allows users to grant themselves or others access to any functionality in the application. It should only be granted to trusted users.</p> </li> <li> <p> <code>ManageAttributeSets</code> – Group members can manage attribute sets.</p> </li> <li> <p> <code>ViewAuditData</code> – Group members can view audit data.</p> </li> <li> <p> <code>AccessNotebooks</code> – Group members will have access to FinSpace notebooks.</p> </li> <li> <p> <code>GetTemporaryCredentials</code> – Group members can get temporary API credentials.</p> </li> </ul>"
         },
         "clientToken":{
           "shape":"ClientToken",
diff --git a/botocore/data/polly/2016-06-10/service-2.json b/botocore/data/polly/2016-06-10/service-2.json
index 1dffb747c..8c4c56f11 100644
--- a/botocore/data/polly/2016-06-10/service-2.json
+++ b/botocore/data/polly/2016-06-10/service-2.json
@@ -1077,7 +1077,11 @@
         "Aria",
         "Ayanda",
         "Arlet",
-        "Hannah"
+        "Hannah",
+        "Arthur",
+        "Daniel",
+        "Liam",
+        "Pedro"
       ]
     },
     "VoiceList":{
diff --git a/docs/source/conf.py b/docs/source/conf.py
index 5906d9d4b..623b44464 100644
--- a/docs/source/conf.py
+++ b/docs/source/conf.py
@@ -54,7 +54,7 @@ copyright = u'2013, Mitch Garnaat'
 # The short X.Y version.
 version = '1.27.'
 # The full version, including alpha/beta/rc tags.
-release = '1.27.18'
+release = '1.27.19'
 
 # The language for content autogenerated by Sphinx. Refer to documentation
 # for a list of supported languages.


Test patch:
diff --git a/tests/unit/test_client.py b/tests/unit/test_client.py
index e952ddd0b..59699f466 100644
--- a/tests/unit/test_client.py
+++ b/tests/unit/test_client.py
@@ -10,8 +10,11 @@
 # distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF
 # ANY KIND, either express or implied. See the License for the specific
 # language governing permissions and limitations under the License.
+import os
 from contextlib import closing
 
+import pytest
+
 import botocore
 import botocore.config
 from botocore import client, exceptions, hooks
@@ -1607,6 +1610,27 @@ class TestAutoGeneratedClient(unittest.TestCase):
 
         self.endpoint.close.assert_called_once_with()
 
+    def test_sslCommonName_warning(self):
+        creator = self.create_client_creator()
+        self.endpoint_data['sslCommonName'] = 'bar'
+
+        with self.assertWarns(FutureWarning) as warning:
+            creator.create_client(
+                'myservice', 'us-west-2', credentials=self.credentials
+            )
+            self.assertEqual(len(warning.warnings), 1)
+
+    @mock.patch.dict(os.environ, {'BOTO_DISABLE_COMMONNAME': 'true'})
+    def test_BOTO_DISABLE_COMMONNAME(self):
+        creator = self.create_client_creator()
+        self.endpoint_data['sslCommonName'] = 'bar'
+
+        with pytest.warns(None) as warning:
+            creator.create_client(
+                'myservice', 'us-west-2', credentials=self.credentials
+            )
+            self.assertEqual(len(warning), 0)
+
 
 class TestClientErrors(TestAutoGeneratedClient):
     def add_error_response(self, error_response):