Repository: boto/botocore
Pull request #2652 (2022-03-29 19:55:18)

Enable "check_hostname" only if proxy url is not Ip adress
**Describe the changes**
This change uses `prox_url` to create `proxy_ssl_context ` as we don't need to enable `check_hostname` if the provided proxy url host is an ip address. This uses `is_ipaddress` similar to how urllib3 uses to determine if the provided hostname is an ip address, if not `check_hostname` is enabled.
The change is to fix issue https://github.com/boto/botocore/issues/2645, where using ip address in proxy url inside proxy config fails to send http request due to error `"ValueError: check_hostname requires server_hostname"`.

**Testing**
Unit tests

codecov-commenter: # [Codecov](https://codecov.io/gh/boto/botocore/pull/2652?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=boto) Report
> Merging [#2652](https://codecov.io/gh/boto/botocore/pull/2652?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=boto) (3a3a34c) into [develop](https://codecov.io/gh/boto/botocore/commit/8df233ca1130c7b7285b8310a8173ec77a3ac64b?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=boto) (8df233c) will **decrease** coverage by `0.05%`.
> The diff coverage is `100.00%`.

```diff
@@             Coverage Diff             @@
##           develop    #2652      +/-   ##
===========================================
- Coverage    95.26%   95.20%   -0.06%     
===========================================
  Files           60       60              
  Lines        12162    12164       +2     
===========================================
- Hits         11586    11581       -5     
- Misses         576      583       +7     
```


| [Impacted Files](https://codecov.io/gh/boto/botocore/pull/2652?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=boto) | Coverage Δ | |
|---|---|---|
| [botocore/httpsession.py](https://codecov.io/gh/boto/botocore/pull/2652/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=boto#diff-Ym90b2NvcmUvaHR0cHNlc3Npb24ucHk=) | `91.09% <100.00%> (-0.34%)` | :arrow_down: |
| [botocore/compat.py](https://codecov.io/gh/boto/botocore/pull/2652/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=boto#diff-Ym90b2NvcmUvY29tcGF0LnB5) | `72.13% <0.00%> (-1.10%)` | :arrow_down: |
| [botocore/utils.py](https://codecov.io/gh/boto/botocore/pull/2652/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=boto#diff-Ym90b2NvcmUvdXRpbHMucHk=) | `95.51% <0.00%> (-0.24%)` | :arrow_down: |
| [botocore/credentials.py](https://codecov.io/gh/boto/botocore/pull/2652/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=boto#diff-Ym90b2NvcmUvY3JlZGVudGlhbHMucHk=) | `98.54% <0.00%> (-0.11%)` | :arrow_down: |

------

[Continue to review full report at Codecov](https://codecov.io/gh/boto/botocore/pull/2652?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=boto).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=boto)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/boto/botocore/pull/2652?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=boto). Last update [8df233c...3a3a34c](https://codecov.io/gh/boto/botocore/pull/2652?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=boto). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=boto).


Patch:
diff --git a/.changes/1.24.34.json b/.changes/1.24.34.json
new file mode 100644
index 000000000..c85947f52
--- /dev/null
+++ b/.changes/1.24.34.json
@@ -0,0 +1,22 @@
+[
+  {
+    "category": "``securityhub``",
+    "description": "Added additional ASFF details for RdsSecurityGroup AutoScalingGroup, ElbLoadBalancer, CodeBuildProject and RedshiftCluster.",
+    "type": "api-change"
+  },
+  {
+    "category": "``fsx``",
+    "description": "Provide customers more visibility into file system status by adding new \"Misconfigured Unavailable\" status for Amazon FSx for Windows File Server.",
+    "type": "api-change"
+  },
+  {
+    "category": "``s3control``",
+    "description": "Documentation-only update for doc bug fixes for the S3 Control API docs.",
+    "type": "api-change"
+  },
+  {
+    "category": "``datasync``",
+    "description": "AWS DataSync now supports Amazon FSx for OpenZFS locations.",
+    "type": "api-change"
+  }
+]
\ No newline at end of file
diff --git a/.changes/next-release/bugfix-Proxy-75735.json b/.changes/next-release/bugfix-Proxy-75735.json
new file mode 100644
index 000000000..12eea29c0
--- /dev/null
+++ b/.changes/next-release/bugfix-Proxy-75735.json
@@ -0,0 +1,5 @@
+{
+  "type": "bugfix",
+  "category": "Proxy",
+  "description": "Fix failure case for IP proxy addresses using TLS-in-TLS. `boto/botocore#2652 <https://github.com/boto/botocore/pull/2652>`__"
+}
diff --git a/CHANGELOG.rst b/CHANGELOG.rst
index a31c7e16c..7f70d487f 100644
--- a/CHANGELOG.rst
+++ b/CHANGELOG.rst
@@ -2,6 +2,15 @@
 CHANGELOG
 =========
 
+1.24.34
+=======
+
+* api-change:``securityhub``: Added additional ASFF details for RdsSecurityGroup AutoScalingGroup, ElbLoadBalancer, CodeBuildProject and RedshiftCluster.
+* api-change:``fsx``: Provide customers more visibility into file system status by adding new "Misconfigured Unavailable" status for Amazon FSx for Windows File Server.
+* api-change:``s3control``: Documentation-only update for doc bug fixes for the S3 Control API docs.
+* api-change:``datasync``: AWS DataSync now supports Amazon FSx for OpenZFS locations.
+
+
 1.24.33
 =======
 
diff --git a/botocore/__init__.py b/botocore/__init__.py
index 735a80798..74fa432e9 100644
--- a/botocore/__init__.py
+++ b/botocore/__init__.py
@@ -16,7 +16,7 @@ import logging
 import os
 import re
 
-__version__ = '1.24.33'
+__version__ = '1.24.34'
 
 
 class NullHandler(logging.Handler):
diff --git a/botocore/data/datasync/2018-11-09/service-2.json b/botocore/data/datasync/2018-11-09/service-2.json
index 3621fc9c5..532a658a1 100644
--- a/botocore/data/datasync/2018-11-09/service-2.json
+++ b/botocore/data/datasync/2018-11-09/service-2.json
@@ -70,6 +70,20 @@
       ],
       "documentation":"<p>Creates an endpoint for an Amazon FSx for Lustre file system.</p>"
     },
+    "CreateLocationFsxOpenZfs":{
+      "name":"CreateLocationFsxOpenZfs",
+      "http":{
+        "method":"POST",
+        "requestUri":"/"
+      },
+      "input":{"shape":"CreateLocationFsxOpenZfsRequest"},
+      "output":{"shape":"CreateLocationFsxOpenZfsResponse"},
+      "errors":[
+        {"shape":"InvalidRequestException"},
+        {"shape":"InternalException"}
+      ],
+      "documentation":"<p>Creates an endpoint for an Amazon FSx for OpenZFS file system.</p>"
+    },
     "CreateLocationFsxWindows":{
       "name":"CreateLocationFsxWindows",
       "http":{
@@ -250,7 +264,21 @@
         {"shape":"InvalidRequestException"},
         {"shape":"InternalException"}
       ],
-      "documentation":"<p>Returns metadata, such as the path information about an Amazon FSx for Lustre location.</p>"
+      "documentation":"<p>Returns metadata about an Amazon FSx for Lustre location, such as information about its path.</p>"
+    },
+    "DescribeLocationFsxOpenZfs":{
+      "name":"DescribeLocationFsxOpenZfs",
+      "http":{
+        "method":"POST",
+        "requestUri":"/"
+      },
+      "input":{"shape":"DescribeLocationFsxOpenZfsRequest"},
+      "output":{"shape":"DescribeLocationFsxOpenZfsResponse"},
+      "errors":[
+        {"shape":"InvalidRequestException"},
+        {"shape":"InternalException"}
+      ],
+      "documentation":"<p>Returns metadata about an Amazon FSx for OpenZFS location, such as information about its path.</p>"
     },
     "DescribeLocationFsxWindows":{
       "name":"DescribeLocationFsxWindows",
@@ -264,7 +292,7 @@
         {"shape":"InvalidRequestException"},
         {"shape":"InternalException"}
       ],
-      "documentation":"<p>Returns metadata, such as the path information about an Amazon FSx for Windows File Server location.</p>"
+      "documentation":"<p>Returns metadata about an Amazon FSx for Windows File Server location, such as information about its path.</p>"
     },
     "DescribeLocationHdfs":{
       "name":"DescribeLocationHdfs",
@@ -759,6 +787,45 @@
         }
       }
     },
+    "CreateLocationFsxOpenZfsRequest":{
+      "type":"structure",
+      "required":[
+        "FsxFilesystemArn",
+        "Protocol",
+        "SecurityGroupArns"
+      ],
+      "members":{
+        "FsxFilesystemArn":{
+          "shape":"FsxFilesystemArn",
+          "documentation":"<p>The Amazon Resource Name (ARN) of the FSx for OpenZFS file system.</p>"
+        },
+        "Protocol":{
+          "shape":"FsxProtocol",
+          "documentation":"<p>The type of protocol that DataSync uses to access your file system.</p>"
+        },
+        "SecurityGroupArns":{
+          "shape":"Ec2SecurityGroupArnList",
+          "documentation":"<p>The ARNs of the security groups that are used to configure the FSx for OpenZFS file system.</p>"
+        },
+        "Subdirectory":{
+          "shape":"FsxOpenZfsSubdirectory",
+          "documentation":"<p>A subdirectory in the location's path that must begin with <code>/fsx</code>. DataSync uses this subdirectory to read or write data (depending on whether the file system is a source or destination location).</p>"
+        },
+        "Tags":{
+          "shape":"InputTagList",
+          "documentation":"<p>The key-value pair that represents a tag that you want to add to the resource. The value can be an empty string. This value helps you manage, filter, and search for your resources. We recommend that you create a name tag for your location.</p>"
+        }
+      }
+    },
+    "CreateLocationFsxOpenZfsResponse":{
+      "type":"structure",
+      "members":{
+        "LocationArn":{
+          "shape":"LocationArn",
+          "documentation":"<p>The ARN of the FSx for OpenZFS file system location that you created.</p>"
+        }
+      }
+    },
     "CreateLocationFsxWindowsRequest":{
       "type":"structure",
       "required":[
@@ -778,7 +845,7 @@
         },
         "SecurityGroupArns":{
           "shape":"Ec2SecurityGroupArnList",
-          "documentation":"<p>The Amazon Resource Names (ARNs) of the security groups that are used to configure the FSx for Windows File Server file system.</p>"
+          "documentation":"<p>The ARNs of the security groups that are used to configure the FSx for Windows File Server file system.</p>"
         },
         "Tags":{
           "shape":"InputTagList",
@@ -803,7 +870,7 @@
       "members":{
         "LocationArn":{
           "shape":"LocationArn",
-          "documentation":"<p>The Amazon Resource Name (ARN) of the FSx for Windows File Server file system location that is created.</p>"
+          "documentation":"<p>The Amazon Resource Name (ARN) of the FSx for Windows File Server file system location you created.</p>"
         }
       }
     },
@@ -892,7 +959,7 @@
         },
         "ServerHostname":{
           "shape":"ServerHostname",
-          "documentation":"<p>The name of the NFS server. This value is the IP address or Domain Name Service (DNS) name of the NFS server. An agent that is installed on-premises uses this host name to mount the NFS server in a network. </p> <p>If you are copying data to or from your Snowcone device, see <a href=\"https://docs.aws.amazon.com/datasync/latest/userguide/create-nfs-location.html#nfs-on-snowcone\">NFS Server on Snowcone</a> for more information.</p> <note> <p>This name must either be DNS-compliant or must be an IP version 4 (IPv4) address.</p> </note>"
+          "documentation":"<p>The name of the NFS server. This value is the IP address or Domain Name Service (DNS) name of the NFS server. An agent that is installed on-premises uses this hostname to mount the NFS server in a network. </p> <p>If you are copying data to or from your Snowcone device, see <a href=\"https://docs.aws.amazon.com/datasync/latest/userguide/create-nfs-location.html#nfs-on-snowcone\">NFS Server on Snowcone</a> for more information.</p> <note> <p>This name must either be DNS-compliant or must be an IP version 4 (IPv4) address.</p> </note>"
         },
         "OnPremConfig":{
           "shape":"OnPremConfig",
@@ -929,7 +996,7 @@
       "members":{
         "ServerHostname":{
           "shape":"ServerHostname",
-          "documentation":"<p>The name of the self-managed object storage server. This value is the IP address or Domain Name Service (DNS) name of the object storage server. An agent uses this host name to mount the object storage server in a network. </p>"
+          "documentation":"<p>The name of the self-managed object storage server. This value is the IP address or Domain Name Service (DNS) name of the object storage server. An agent uses this hostname to mount the object storage server in a network. </p>"
         },
         "ServerPort":{
           "shape":"ObjectStorageServerPort",
@@ -998,7 +1065,7 @@
         "S3Config":{"shape":"S3Config"},
         "AgentArns":{
           "shape":"AgentArnList",
-          "documentation":"<p>If you are using DataSync on an Amazon Web Services Outpost, specify the Amazon Resource Names (ARNs) of the DataSync agents deployed on your Outpost. For more information about launching a DataSync agent on an Amazon Web Services Outpost, see <a href=\"https://docs.aws.amazon.com/datasync/latest/userguide/deploy-agents.html#outposts-agent\">Deploy your DataSync agent on Outposts</a>.</p>"
+          "documentation":"<p>If you're using DataSync on an Amazon Web Services Outpost, specify the Amazon Resource Names (ARNs) of the DataSync agents deployed on your Outpost. For more information about launching a DataSync agent on an Amazon Web Services Outpost, see <a href=\"https://docs.aws.amazon.com/datasync/latest/userguide/deploy-agents.html#outposts-agent\">Deploy your DataSync agent on Outposts</a>.</p>"
         },
         "Tags":{
           "shape":"InputTagList",
@@ -1282,6 +1349,41 @@
         }
       }
     },
+    "DescribeLocationFsxOpenZfsRequest":{
+      "type":"structure",
+      "required":["LocationArn"],
+      "members":{
+        "LocationArn":{
+          "shape":"LocationArn",
+          "documentation":"<p>The Amazon Resource Name (ARN) of the FSx for OpenZFS location to describe.</p>"
+        }
+      }
+    },
+    "DescribeLocationFsxOpenZfsResponse":{
+      "type":"structure",
+      "members":{
+        "LocationArn":{
+          "shape":"LocationArn",
+          "documentation":"<p>The ARN of the FSx for OpenZFS location that was described.</p>"
+        },
+        "LocationUri":{
+          "shape":"LocationUri",
+          "documentation":"<p>The uniform resource identifier (URI) of the FSx for OpenZFS location that was described.</p> <p>Example: <code>fsxz://us-west-2.fs-1234567890abcdef02/fsx/folderA/folder</code> </p>"
+        },
+        "SecurityGroupArns":{
+          "shape":"Ec2SecurityGroupArnList",
+          "documentation":"<p>The ARNs of the security groups that are configured for the FSx for OpenZFS file system.</p>"
+        },
+        "Protocol":{
+          "shape":"FsxProtocol",
+          "documentation":"<p>The type of protocol that DataSync uses to access your file system.</p>"
+        },
+        "CreationTime":{
+          "shape":"Time",
+          "documentation":"<p>The time that the FSx for OpenZFS location was created.</p>"
+        }
+      }
+    },
     "DescribeLocationFsxWindowsRequest":{
       "type":"structure",
       "required":["LocationArn"],
@@ -1706,14 +1808,14 @@
       "members":{
         "SubnetArn":{
           "shape":"Ec2SubnetArn",
-          "documentation":"<p>The ARN of the subnet and the security group that DataSync uses to access the target EFS file system.</p>"
+          "documentation":"<p>The ARN of the subnet that DataSync uses to access the target EFS file system.</p>"
         },
         "SecurityGroupArns":{
           "shape":"Ec2SecurityGroupArnList",
           "documentation":"<p>The Amazon Resource Names (ARNs) of the security groups that are configured for the Amazon EC2 resource.</p>"
         }
       },
-      "documentation":"<p>The subnet and the security group that DataSync uses to access target EFS file system. The subnet must have at least one mount target for that file system. The security group that you provide needs to be able to communicate with the security group on the mount target in the subnet specified. </p>"
+      "documentation":"<p>The subnet that DataSync uses to access target EFS file system. The subnet must have at least one mount target for that file system. The security group that you provide needs to be able to communicate with the security group on the mount target in the subnet specified. </p>"
     },
     "Ec2SecurityGroupArn":{
       "type":"string",
@@ -1789,7 +1891,7 @@
     },
     "FilterValue":{
       "type":"string",
-      "max":409600,
+      "max":102400,
       "pattern":"^[^\\x00]+$"
     },
     "FilterValues":{
@@ -1806,6 +1908,28 @@
       "max":4096,
       "pattern":"^[a-zA-Z0-9_\\-\\+\\./\\(\\)\\$\\p{Zs}]+$"
     },
+    "FsxOpenZfsSubdirectory":{
+      "type":"string",
+      "max":4096,
+      "pattern":"^[^\\u0000\\u0085\\u2028\\u2029\\r\\n]{1,4096}$"
+    },
+    "FsxProtocol":{
+      "type":"structure",
+      "members":{
+        "NFS":{
+          "shape":"FsxProtocolNfs",
+          "documentation":"<p>Represents the Network File System (NFS) protocol that DataSync uses to access your FSx for OpenZFS file system.</p>"
+        }
+      },
+      "documentation":"<p>Represents the protocol that DataSync uses to access your Amazon FSx for OpenZFS file system.</p>"
+    },
+    "FsxProtocolNfs":{
+      "type":"structure",
+      "members":{
+        "MountOptions":{"shape":"NfsMountOptions"}
+      },
+      "documentation":"<p>Represents the Network File System (NFS) protocol that DataSync uses to access your Amazon FSx for OpenZFS file system.</p>"
+    },
     "FsxWindowsSubdirectory":{
       "type":"string",
       "max":4096,
@@ -2163,7 +2287,7 @@
         },
         "LocationUri":{
           "shape":"LocationUri",
-          "documentation":"<p>Represents a list of URIs of a location. <code>LocationUri</code> returns an array that contains a list of locations when the <a href=\"https://docs.aws.amazon.com/datasync/latest/userguide/API_ListLocations.html\">ListLocations</a> operation is called.</p> <p>Format: <code>TYPE://GLOBAL_ID/SUBDIR</code>.</p> <p>TYPE designates the type of location. Valid values: NFS | EFS | S3.</p> <p>GLOBAL_ID is the globally unique identifier of the resource that backs the location. An example for EFS is <code>us-east-2.fs-abcd1234</code>. An example for Amazon S3 is the bucket name, such as <code>myBucket</code>. An example for NFS is a valid IPv4 address or a host name compliant with Domain Name Service (DNS).</p> <p>SUBDIR is a valid file system path, delimited by forward slashes as is the *nix convention. For NFS and Amazon EFS, it's the export path to mount the location. For Amazon S3, it's the prefix path that you mount to and treat as the root of the location.</p> <p/>"
+          "documentation":"<p>Represents a list of URIs of a location. <code>LocationUri</code> returns an array that contains a list of locations when the <a href=\"https://docs.aws.amazon.com/datasync/latest/userguide/API_ListLocations.html\">ListLocations</a> operation is called.</p> <p>Format: <code>TYPE://GLOBAL_ID/SUBDIR</code>.</p> <p>TYPE designates the type of location (for example, <code>nfs</code> or <code>s3</code>).</p> <p>GLOBAL_ID is the globally unique identifier of the resource that backs the location. An example for EFS is <code>us-east-2.fs-abcd1234</code>. An example for Amazon S3 is the bucket name, such as <code>myBucket</code>. An example for NFS is a valid IPv4 address or a hostname that is compliant with Domain Name Service (DNS).</p> <p>SUBDIR is a valid file system path, delimited by forward slashes as is the *nix convention. For NFS and Amazon EFS, it's the export path to mount the location. For Amazon S3, it's the prefix path that you mount to and treat as the root of the location.</p> <p/>"
         }
       },
       "documentation":"<p>Represents a single entry in a list of locations. <code>LocationListEntry</code> returns an array that contains a list of locations when the <a href=\"https://docs.aws.amazon.com/datasync/latest/userguide/API_ListLocations.html\">ListLocations</a> operation is called.</p>"
@@ -2171,7 +2295,7 @@
     "LocationUri":{
       "type":"string",
       "max":4356,
-      "pattern":"^(efs|nfs|s3|smb|fsxw|fsxl)://[a-zA-Z0-9.\\-]+$"
+      "pattern":"^(efs|nfs|s3|smb|hdfs|fsx[a-z0-9]+)://[a-zA-Z0-9.:/\\-]+$"
     },
     "LogGroupArn":{
       "type":"string",
@@ -2453,10 +2577,10 @@
       "members":{
         "BucketAccessRoleArn":{
           "shape":"IamRoleArn",
-          "documentation":"<p>The Amazon S3 bucket to access. This bucket is used as a parameter in the <a href=\"https://docs.aws.amazon.com/datasync/latest/userguide/API_CreateLocationS3.html\">CreateLocationS3</a> operation. </p>"
+          "documentation":"<p>The ARN of the IAM role for accessing the S3 bucket. </p>"
         }
       },
-      "documentation":"<p>The Amazon Resource Name (ARN) of the Identity and Access Management (IAM) role that is used to access an Amazon S3 bucket.</p> <p>For detailed information about using such a role, see Creating a Location for Amazon S3 in the <i>DataSync User Guide</i>.</p>"
+      "documentation":"<p>The Amazon Resource Name (ARN) of the Identity and Access Management (IAM) role used to access an Amazon S3 bucket.</p> <p>For detailed information about using such a role, see Creating a Location for Amazon S3 in the <i>DataSync User Guide</i>.</p>"
     },
     "S3StorageClass":{
       "type":"string",
@@ -2899,11 +3023,11 @@
         },
         "KerberosKeytab":{
           "shape":"KerberosKeytabFile",
-          "documentation":"<p>The Kerberos key table (keytab) that contains mappings between the defined Kerberos principal and the encrypted keys. You can load the keytab from a file by providing the file's address. If you use the AWS CLI, it performs base64 encoding for you. Otherwise, provide the base64-encoded text.</p>"
+          "documentation":"<p>The Kerberos key table (keytab) that contains mappings between the defined Kerberos principal and the encrypted keys. You can load the keytab from a file by providing the file's address. If you use the CLI, it performs base64 encoding for you. Otherwise, provide the base64-encoded text.</p>"
         },
         "KerberosKrb5Conf":{
           "shape":"KerberosKrb5ConfFile",
-          "documentation":"<p>The <code>krb5.conf</code> file that contains the Kerberos configuration information. You can load the <code>krb5.conf</code> file by providing the file's address. If you're using the AWS CLI, it performs the base64 encoding for you. Otherwise, provide the base64-encoded text.</p>"
+          "documentation":"<p>The <code>krb5.conf</code> file that contains the Kerberos configuration information. You can load the <code>krb5.conf</code> file by providing the file's address. If you're using the CLI, it performs the base64 encoding for you. Otherwise, provide the base64-encoded text.</p>"
         },
         "AgentArns":{
           "shape":"AgentArnList",
diff --git a/botocore/data/fsx/2018-03-01/service-2.json b/botocore/data/fsx/2018-03-01/service-2.json
index 9a34cdb1f..bb702054d 100644
--- a/botocore/data/fsx/2018-03-01/service-2.json
+++ b/botocore/data/fsx/2018-03-01/service-2.json
@@ -2809,7 +2809,7 @@
         },
         "Lifecycle":{
           "shape":"FileSystemLifecycle",
-          "documentation":"<p>The lifecycle status of the file system. The following are the possible values and what they mean:</p> <ul> <li> <p> <code>AVAILABLE</code> - The file system is in a healthy state, and is reachable and available for use.</p> </li> <li> <p> <code>CREATING</code> - Amazon FSx is creating the new file system.</p> </li> <li> <p> <code>DELETING</code> - Amazon FSx is deleting an existing file system.</p> </li> <li> <p> <code>FAILED</code> - An existing file system has experienced an unrecoverable failure. When creating a new file system, Amazon FSx was unable to create the file system.</p> </li> <li> <p> <code>MISCONFIGURED</code> - The file system is in a failed but recoverable state.</p> </li> <li> <p> <code>UPDATING</code> - The file system is undergoing a customer-initiated update.</p> </li> </ul>"
+          "documentation":"<p>The lifecycle status of the file system. The following are the possible values and what they mean:</p> <ul> <li> <p> <code>AVAILABLE</code> - The file system is in a healthy state, and is reachable and available for use.</p> </li> <li> <p> <code>CREATING</code> - Amazon FSx is creating the new file system.</p> </li> <li> <p> <code>DELETING</code> - Amazon FSx is deleting an existing file system.</p> </li> <li> <p> <code>FAILED</code> - An existing file system has experienced an unrecoverable failure. When creating a new file system, Amazon FSx was unable to create the file system.</p> </li> <li> <p> <code>MISCONFIGURED</code> - The file system is in a failed but recoverable state.</p> </li> <li> <p> <code>MISCONFIGURED_UNAVAILABLE</code> - (Amazon FSx for Windows File Server only) The file system is currently unavailable due to a change in your Active Directory configuration.</p> </li> <li> <p> <code>UPDATING</code> - The file system is undergoing a customer-initiated update.</p> </li> </ul>"
         },
         "FailureDetails":{"shape":"FileSystemFailureDetails"},
         "StorageCapacity":{
@@ -2935,7 +2935,8 @@
         "FAILED",
         "DELETING",
         "MISCONFIGURED",
-        "UPDATING"
+        "UPDATING",
+        "MISCONFIGURED_UNAVAILABLE"
       ]
     },
     "FileSystemMaintenanceOperation":{
@@ -3869,7 +3870,7 @@
         },
         "Options":{
           "shape":"RestoreOpenZFSVolumeOptions",
-          "documentation":"<p>The settings used when restoring the specified volume from snapshot. </p> <ul> <li> <p> <code>DELETE_INTERMEDIATE_SNAPSHOTS</code> - Deletes snapshots between the current state and the specified snapshot. If there are intermediate snapshots and this option isn't used, <code>RestoreVolumeFromSnapshot</code> fails.</p> </li> <li> <p> <code>DELETE_CLONED_VOLUMES</code> - Deletes any volumes cloned from this volume. If there are any cloned volumes and this option isn't used, <code>RestoreVolumeFromSnapshot</code> fails.</p> </li> </ul>"
+          "documentation":"<p>The settings used when restoring the specified volume from snapshot. </p> <ul> <li> <p> <code>DELETE_INTERMEDIATE_SNAPSHOTS</code> - Deletes snapshots between the current state and the specified snapshot. If there are intermediate snapshots and this option isn't used, <code>RestoreVolumeFromSnapshot</code> fails.</p> </li> <li> <p> <code>DELETE_CLONED_VOLUMES</code> - Deletes any dependent clone volumes created from intermediate snapshots. If there are any dependent clone volumes and this option isn't used, <code>RestoreVolumeFromSnapshot</code> fails.</p> </li> </ul>"
         }
       }
     },
@@ -4595,7 +4596,7 @@
         },
         "ThroughputCapacity":{
           "shape":"MegabytesPerSecond",
-          "documentation":"<p>Specifies the throughput of an FSx for NetApp ONTAP file system, measured in megabytes per second (MBps). Valid values are 64, 128, 256, 512, 1024, 2048, 3072, or 4096 MB/s.</p>"
+          "documentation":"<p>Specifies the throughput of an FSx for NetApp ONTAP file system, measured in megabytes per second (MBps). Valid values are 128, 256, 512, 1024, or 2048 MB/s.</p>"
         }
       },
       "documentation":"<p>The configuration updates for an Amazon FSx for NetApp ONTAP file system.</p>"
diff --git a/botocore/data/s3control/2018-08-20/service-2.json b/botocore/data/s3control/2018-08-20/service-2.json
index 085065aeb..d712b5d4b 100644
--- a/botocore/data/s3control/2018-08-20/service-2.json
+++ b/botocore/data/s3control/2018-08-20/service-2.json
@@ -742,7 +742,7 @@
         {"shape":"NotFoundException"},
         {"shape":"TooManyTagsException"}
       ],
-      "documentation":"<p>Sets the supplied tag-set on an S3 Batch Operations job.</p> <p>A tag is a key-value pair. You can associate S3 Batch Operations tags with any job by sending a PUT request against the tagging subresource that is associated with the job. To modify the existing tag set, you can either replace the existing tag set entirely, or make changes within the existing tag set by retrieving the existing tag set using <a href=\"https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetJobTagging.html\">GetJobTagging</a>, modify that tag set, and use this action to replace the tag set with the one you modified. For more information, see <a href=\"https://docs.aws.amazon.com/AmazonS3/latest/dev/batch-ops-managing-jobs.html#batch-ops-job-tags\">Controlling access and labeling jobs using tags</a> in the <i>Amazon S3 User Guide</i>. </p> <p/> <note> <ul> <li> <p>If you send this request with an empty tag set, Amazon S3 deletes the existing tag set on the Batch Operations job. If you use this method, you are charged for a Tier 1 Request (PUT). For more information, see <a href=\"http://aws.amazon.com/s3/pricing/\">Amazon S3 pricing</a>.</p> </li> <li> <p>For deleting existing tags for your Batch Operations job, a <a href=\"https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_DeleteJobTagging.html\">DeleteJobTagging</a> request is preferred because it achieves the same result without incurring charges.</p> </li> <li> <p>A few things to consider about using tags:</p> <ul> <li> <p>Amazon S3 limits the maximum number of tags to 50 tags per job.</p> </li> <li> <p>You can associate up to 50 tags with a job as long as they have unique tag keys.</p> </li> <li> <p>A tag key can be up to 128 Unicode characters in length, and tag values can be up to 256 Unicode characters in length.</p> </li> <li> <p>The key and values are case sensitive.</p> </li> <li> <p>For tagging-related restrictions related to characters and encodings, see <a href=\"https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/allocation-tag-restrictions.html\">User-Defined Tag Restrictions</a> in the <i>Billing and Cost Management User Guide</i>.</p> </li> </ul> </li> </ul> </note> <p/> <p>To use this action, you must have permission to perform the <code>s3:PutJobTagging</code> action.</p> <p>Related actions include:</p> <ul> <li> <p> <a href=\"https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_CreateJob.html\">CreatJob</a> </p> </li> <li> <p> <a href=\"https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetJobTagging.html\">GetJobTagging</a> </p> </li> <li> <p> <a href=\"https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_DeleteJobTagging.html\">DeleteJobTagging</a> </p> </li> </ul>",
+      "documentation":"<p>Sets the supplied tag-set on an S3 Batch Operations job.</p> <p>A tag is a key-value pair. You can associate S3 Batch Operations tags with any job by sending a PUT request against the tagging subresource that is associated with the job. To modify the existing tag set, you can either replace the existing tag set entirely, or make changes within the existing tag set by retrieving the existing tag set using <a href=\"https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetJobTagging.html\">GetJobTagging</a>, modify that tag set, and use this action to replace the tag set with the one you modified. For more information, see <a href=\"https://docs.aws.amazon.com/AmazonS3/latest/dev/batch-ops-managing-jobs.html#batch-ops-job-tags\">Controlling access and labeling jobs using tags</a> in the <i>Amazon S3 User Guide</i>. </p> <p/> <note> <ul> <li> <p>If you send this request with an empty tag set, Amazon S3 deletes the existing tag set on the Batch Operations job. If you use this method, you are charged for a Tier 1 Request (PUT). For more information, see <a href=\"http://aws.amazon.com/s3/pricing/\">Amazon S3 pricing</a>.</p> </li> <li> <p>For deleting existing tags for your Batch Operations job, a <a href=\"https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_DeleteJobTagging.html\">DeleteJobTagging</a> request is preferred because it achieves the same result without incurring charges.</p> </li> <li> <p>A few things to consider about using tags:</p> <ul> <li> <p>Amazon S3 limits the maximum number of tags to 50 tags per job.</p> </li> <li> <p>You can associate up to 50 tags with a job as long as they have unique tag keys.</p> </li> <li> <p>A tag key can be up to 128 Unicode characters in length, and tag values can be up to 256 Unicode characters in length.</p> </li> <li> <p>The key and values are case sensitive.</p> </li> <li> <p>For tagging-related restrictions related to characters and encodings, see <a href=\"https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/allocation-tag-restrictions.html\">User-Defined Tag Restrictions</a> in the <i>Billing and Cost Management User Guide</i>.</p> </li> </ul> </li> </ul> </note> <p/> <p>To use this action, you must have permission to perform the <code>s3:PutJobTagging</code> action.</p> <p>Related actions include:</p> <ul> <li> <p> <a href=\"https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_CreateJob.html\">CreateJob</a> </p> </li> <li> <p> <a href=\"https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_GetJobTagging.html\">GetJobTagging</a> </p> </li> <li> <p> <a href=\"https://docs.aws.amazon.com/AmazonS3/latest/API/API_control_DeleteJobTagging.html\">DeleteJobTagging</a> </p> </li> </ul>",
       "endpoint":{
         "hostPrefix":"{AccountId}."
       }
@@ -4468,7 +4468,7 @@
         },
         "TargetKeyPrefix":{
           "shape":"NonEmptyMaxLength1024String",
-          "documentation":"<p>Specifies the folder prefix into which you would like the objects to be copied. For example, to copy objects into a folder named \"Folder1\" in the destination bucket, set the TargetKeyPrefix to \"Folder1/\".</p>"
+          "documentation":"<p>Specifies the folder prefix into which you would like the objects to be copied. For example, to copy objects into a folder named <code>Folder1</code> in the destination bucket, set the TargetKeyPrefix to <code>Folder1</code>.</p>"
         },
         "ObjectLockLegalHoldStatus":{
           "shape":"S3ObjectLockLegalHoldStatus",
diff --git a/botocore/data/securityhub/2018-10-26/service-2.json b/botocore/data/securityhub/2018-10-26/service-2.json
index 14d5c9cf8..e13531710 100644
--- a/botocore/data/securityhub/2018-10-26/service-2.json
+++ b/botocore/data/securityhub/2018-10-26/service-2.json
@@ -1647,10 +1647,36 @@
         "AvailabilityZones":{
           "shape":"AwsAutoScalingAutoScalingGroupAvailabilityZonesList",
           "documentation":"<p>The list of Availability Zones for the automatic scaling group.</p>"
+        },
+        "LaunchTemplate":{
+          "shape":"AwsAutoScalingAutoScalingGroupLaunchTemplateLaunchTemplateSpecification",
+          "documentation":"<p>The launch template to use.</p>"
+        },
+        "CapacityRebalance":{
+          "shape":"Boolean",
+          "documentation":"<p>Indicates whether capacity rebalancing is enabled. </p>"
         }
       },
       "documentation":"<p>Provides details about an auto scaling group.</p>"
     },
+    "AwsAutoScalingAutoScalingGroupLaunchTemplateLaunchTemplateSpecification":{
+      "type":"structure",
+      "members":{
+        "LaunchTemplateId":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The identifier of the launch template. You must specify either <code>LaunchTemplateId</code> or <code>LaunchTemplateName</code>.</p>"
+        },
+        "LaunchTemplateName":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The name of the launch template. You must specify either <code>LaunchTemplateId</code> or <code>LaunchTemplateName</code>.</p>"
+        },
+        "Version":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>Identifies the version of the launch template. You can specify a version identifier, or use the values <code>$Latest</code> or <code>$Default</code>.</p>"
+        }
+      },
+      "documentation":"<p>Details about the launch template to use.</p>"
+    },
     "AwsAutoScalingAutoScalingGroupMixedInstancesPolicyDetails":{
       "type":"structure",
       "members":{
@@ -1700,7 +1726,7 @@
       "members":{
         "LaunchTemplateSpecification":{
           "shape":"AwsAutoScalingAutoScalingGroupMixedInstancesPolicyLaunchTemplateLaunchTemplateSpecification",
-          "documentation":"<p>The launch template to use.</p>"
+          "documentation":"<p>The launch template to use for a mixed instances policy.</p>"
         },
         "Overrides":{
           "shape":"AwsAutoScalingAutoScalingGroupMixedInstancesPolicyLaunchTemplateOverridesList",
@@ -1725,7 +1751,7 @@
           "documentation":"<p>Identifies the version of the launch template. You can specify a version identifier, or use the values <code>$Latest</code> or <code>$Default</code>.</p>"
         }
       },
-      "documentation":"<p>Details about the launch template to use.</p>"
+      "documentation":"<p>Details about the launch template to use for a mixed instances policy.</p>"
     },
     "AwsAutoScalingAutoScalingGroupMixedInstancesPolicyLaunchTemplateOverridesList":{
       "type":"list",
@@ -2513,6 +2539,10 @@
         "VpcConfig":{
           "shape":"AwsCodeBuildProjectVpcConfig",
           "documentation":"<p>Information about the VPC configuration that CodeBuild accesses.</p>"
+        },
+        "SecondaryArtifacts":{
+          "shape":"AwsCodeBuildProjectArtifactsList",
+          "documentation":"<p>Information about the secondary artifacts for the CodeBuild project.</p>"
         }
       },
       "documentation":"<p>Information about an CodeBuild project.</p>"
@@ -5690,6 +5720,24 @@
       },
       "documentation":"<p>Contains information about the access log configuration for the load balancer.</p>"
     },
+    "AwsElbLoadBalancerAdditionalAttribute":{
+      "type":"structure",
+      "members":{
+        "Key":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The name of the attribute.</p>"
+        },
+        "Value":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The value of the attribute.</p>"
+        }
+      },
+      "documentation":"<p>Provides information about additional attributes for the load balancer.</p>"
+    },
+    "AwsElbLoadBalancerAdditionalAttributeList":{
+      "type":"list",
+      "member":{"shape":"AwsElbLoadBalancerAdditionalAttribute"}
+    },
     "AwsElbLoadBalancerAttributes":{
       "type":"structure",
       "members":{
@@ -5708,6 +5756,10 @@
         "CrossZoneLoadBalancing":{
           "shape":"AwsElbLoadBalancerCrossZoneLoadBalancing",
           "documentation":"<p>Cross-zone load balancing settings for the load balancer.</p> <p>If cross-zone load balancing is enabled, the load balancer routes the request traffic evenly across all instances regardless of the Availability Zones.</p>"
+        },
+        "AdditionalAttributes":{
+          "shape":"AwsElbLoadBalancerAdditionalAttributeList",
+          "documentation":"<p>Any additional attributes for a load balancer.</p>"
         }
       },
       "documentation":"<p>Contains attributes for the load balancer.</p>"
@@ -7800,6 +7852,84 @@
       "type":"list",
       "member":{"shape":"AwsRdsDbProcessorFeature"}
     },
+    "AwsRdsDbSecurityGroupDetails":{
+      "type":"structure",
+      "members":{
+        "DbSecurityGroupArn":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The ARN for the DB security group.</p>"
+        },
+        "DbSecurityGroupDescription":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>Provides the description of the DB security group.</p>"
+        },
+        "DbSecurityGroupName":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>Specifies the name of the DB security group.</p>"
+        },
+        "Ec2SecurityGroups":{
+          "shape":"AwsRdsDbSecurityGroupEc2SecurityGroups",
+          "documentation":"<p>Contains a list of EC2 security groups.</p>"
+        },
+        "IpRanges":{
+          "shape":"AwsRdsDbSecurityGroupIpRanges",
+          "documentation":"<p>Contains a list of IP ranges.</p>"
+        },
+        "OwnerId":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>Provides the Amazon Web Services ID of the owner of a specific DB security group.</p>"
+        },
+        "VpcId":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>Provides VPC ID associated with the DB security group. </p>"
+        }
+      },
+      "documentation":"<p>Provides information about an Amazon RDS DB security group.</p>"
+    },
+    "AwsRdsDbSecurityGroupEc2SecurityGroup":{
+      "type":"structure",
+      "members":{
+        "Ec2SecurityGroupId":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>Specifies the ID for the EC2 security group.</p>"
+        },
+        "Ec2SecurityGroupName":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>Specifies the name of the EC2 security group.</p>"
+        },
+        "Ec2SecurityGroupOwnerId":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>Provides the Amazon Web Services ID of the owner of the EC2 security group.</p>"
+        },
+        "Status":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>Provides the status of the EC2 security group.</p>"
+        }
+      },
+      "documentation":"<p>EC2 security group information for an RDS DB security group.</p>"
+    },
+    "AwsRdsDbSecurityGroupEc2SecurityGroups":{
+      "type":"list",
+      "member":{"shape":"AwsRdsDbSecurityGroupEc2SecurityGroup"}
+    },
+    "AwsRdsDbSecurityGroupIpRange":{
+      "type":"structure",
+      "members":{
+        "CidrIp":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>Specifies the IP range.</p>"
+        },
+        "Status":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>Specifies the status of the IP range.</p>"
+        }
+      },
+      "documentation":"<p>IP range information for an RDS DB security group.</p>"
+    },
+    "AwsRdsDbSecurityGroupIpRanges":{
+      "type":"list",
+      "member":{"shape":"AwsRdsDbSecurityGroupIpRange"}
+    },
     "AwsRdsDbSnapshotDetails":{
       "type":"structure",
       "members":{
@@ -8364,6 +8494,10 @@
         "VpcSecurityGroups":{
           "shape":"AwsRedshiftClusterVpcSecurityGroups",
           "documentation":"<p>The list of VPC security groups that the cluster belongs to, if the cluster is in a VPC.</p>"
+        },
+        "LoggingStatus":{
+          "shape":"AwsRedshiftClusterLoggingStatus",
+          "documentation":"<p>Information about the logging status of the cluster.</p>"
         }
       },
       "documentation":"<p>Details about an Amazon Redshift cluster.</p>"
@@ -8432,6 +8566,36 @@
       "type":"list",
       "member":{"shape":"AwsRedshiftClusterIamRole"}
     },
+    "AwsRedshiftClusterLoggingStatus":{
+      "type":"structure",
+      "members":{
+        "BucketName":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The name of the S3 bucket where the log files are stored.</p>"
+        },
+        "LastFailureMessage":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The message indicating that the logs failed to be delivered.</p>"
+        },
+        "LastFailureTime":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The last time when logs failed to be delivered.</p> <p>Uses the <code>date-time</code> format specified in <a href=\"https://tools.ietf.org/html/rfc3339#section-5.6\">RFC 3339 section 5.6, Internet Date/Time Format</a>. The value cannot contain spaces. For example, <code>2020-03-22T13:22:13.933Z</code>.</p>"
+        },
+        "LastSuccessfulDeliveryTime":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>The last time that logs were delivered successfully.</p> <p>Uses the <code>date-time</code> format specified in <a href=\"https://tools.ietf.org/html/rfc3339#section-5.6\">RFC 3339 section 5.6, Internet Date/Time Format</a>. The value cannot contain spaces. For example, <code>2020-03-22T13:22:13.933Z</code>.</p>"
+        },
+        "LoggingEnabled":{
+          "shape":"Boolean",
+          "documentation":"<p>Indicates whether logging is enabled.</p>"
+        },
+        "S3KeyPrefix":{
+          "shape":"NonEmptyString",
+          "documentation":"<p>Provides the prefix applied to the log file names.</p>"
+        }
+      },
+      "documentation":"<p>Provides information about the logging status of the cluster.</p>"
+    },
     "AwsRedshiftClusterPendingModifiedValues":{
       "type":"structure",
       "members":{
@@ -12982,6 +13146,10 @@
         "AwsNetworkFirewallRuleGroup":{
           "shape":"AwsNetworkFirewallRuleGroupDetails",
           "documentation":"<p>Details about an Network Firewall rule group.</p>"
+        },
+        "AwsRdsDbSecurityGroup":{
+          "shape":"AwsRdsDbSecurityGroupDetails",
+          "documentation":"<p>Details about an Amazon RDS DB security group.</p>"
         }
       },
       "documentation":"<p>Additional details about a resource related to a finding.</p> <p>To provide the details, use the object that corresponds to the resource type. For example, if the resource type is <code>AwsEc2Instance</code>, then you use the <code>AwsEc2Instance</code> object to provide the details.</p> <p>If the type-specific object does not contain all of the fields you want to populate, then you use the <code>Other</code> object to populate those additional fields.</p> <p>You also use the <code>Other</code> object to populate the details when the selected type does not have a corresponding object.</p>"
diff --git a/botocore/httpsession.py b/botocore/httpsession.py
index 42e486ae2..2693cc5ed 100644
--- a/botocore/httpsession.py
+++ b/botocore/httpsession.py
@@ -9,7 +9,12 @@ from urllib3 import PoolManager, Timeout, proxy_from_url
 from urllib3.exceptions import (
     ConnectTimeoutError as URLLib3ConnectTimeoutError,
 )
-from urllib3.exceptions import NewConnectionError, ProtocolError, ProxyError
+from urllib3.exceptions import (
+    LocationParseError,
+    NewConnectionError,
+    ProtocolError,
+    ProxyError,
+)
 from urllib3.exceptions import ReadTimeoutError as URLLib3ReadTimeoutError
 from urllib3.exceptions import SSLError as URLLib3SSLError
 from urllib3.util.retry import Retry
@@ -19,8 +24,10 @@ from urllib3.util.ssl_ import (
     PROTOCOL_TLS,
     OP_NO_SSLv2,
     OP_NO_SSLv3,
+    is_ipaddress,
     ssl,
 )
+from urllib3.util.url import parse_url
 
 try:
     from urllib3.util.ssl_ import OP_NO_TICKET, PROTOCOL_TLS_CLIENT
@@ -36,7 +43,12 @@ except ImportError:
     from urllib3.util.ssl_ import SSLContext
 
 import botocore.awsrequest
-from botocore.compat import ensure_bytes, filter_ssl_warnings, urlparse
+from botocore.compat import (
+    IPV6_ADDRZ_RE,
+    ensure_bytes,
+    filter_ssl_warnings,
+    urlparse,
+)
 from botocore.exceptions import (
     ConnectionClosedError,
     ConnectTimeoutError,
@@ -177,6 +189,11 @@ def mask_proxy_url(proxy_url):
     return proxy_url
 
 
+def _is_ipaddress(host):
+    """Wrap urllib3's is_ipaddress to support bracketed IPv6 addresses."""
+    return is_ipaddress(host) or bool(IPV6_ADDRZ_RE.match(host))
+
+
 class ProxyConfiguration(object):
     """Represents a proxy configuration dictionary and additional settings.
 
@@ -285,14 +302,13 @@ class URLLib3Session(object):
         self._manager = PoolManager(**self._get_pool_manager_kwargs())
         self._manager.pool_classes_by_scheme = self._pool_classes_by_scheme
 
-    @property
-    def _proxies_kwargs(self):
+    def _proxies_kwargs(self, **kwargs):
         proxies_settings = self._proxy_config.settings
-        proxy_ssl_context = self._setup_proxy_ssl_context(proxies_settings)
         proxies_kwargs = {
-            'proxy_ssl_context': proxy_ssl_context,
             'use_forwarding_for_https': proxies_settings.get(
-                'proxy_use_forwarding_for_https'),
+                'proxy_use_forwarding_for_https'
+            ),
+            **kwargs
         }
         return {k: v for k, v in proxies_kwargs.items() if v is not None}
 
@@ -315,9 +331,13 @@ class URLLib3Session(object):
     def _get_proxy_manager(self, proxy_url):
         if proxy_url not in self._proxy_managers:
             proxy_headers = self._proxy_config.proxy_headers_for(proxy_url)
+            proxy_ssl_context = self._setup_proxy_ssl_context(proxy_url)
             proxy_manager_kwargs = self._get_pool_manager_kwargs(
-                proxy_headers=proxy_headers)
-            proxy_manager_kwargs.update(**self._proxies_kwargs)
+                proxy_headers=proxy_headers
+            )
+            proxy_manager_kwargs.update(
+                self._proxies_kwargs(proxy_ssl_context=proxy_ssl_context)
+            )
             proxy_manager = proxy_from_url(proxy_url, **proxy_manager_kwargs)
             proxy_manager.pool_classes_by_scheme = self._pool_classes_by_scheme
             self._proxy_managers[proxy_url] = proxy_manager
@@ -341,7 +361,8 @@ class URLLib3Session(object):
             conn.cert_reqs = 'CERT_NONE'
             conn.ca_certs = None
 
-    def _setup_proxy_ssl_context(self, proxies_settings):
+    def _setup_proxy_ssl_context(self, proxy_url):
+        proxies_settings = self._proxy_config.settings
         proxy_ca_bundle = proxies_settings.get('proxy_ca_bundle')
         proxy_cert = proxies_settings.get('proxy_client_cert')
         if proxy_ca_bundle is None and proxy_cert is None:
@@ -349,9 +370,11 @@ class URLLib3Session(object):
 
         context = self._get_ssl_context()
         try:
-            # urllib3 disables this by default but we need
-            # it for proper proxy tls negotiation.
-            context.check_hostname = True
+            url = parse_url(proxy_url)
+            # urllib3 disables this by default but we need it for proper
+            # proxy tls negotiation when proxy_url is not an IP Address
+            if not _is_ipaddress(url.host):
+                context.check_hostname = True
             if proxy_ca_bundle is not None:
                 context.load_verify_locations(cafile=proxy_ca_bundle)
 
@@ -361,7 +384,7 @@ class URLLib3Session(object):
                 context.load_cert_chain(proxy_cert)
 
             return context
-        except (IOError, URLLib3SSLError) as e:
+        except (IOError, URLLib3SSLError, LocationParseError) as e:
             raise InvalidProxiesConfigError(error=e)
 
     def _get_connection_manager(self, url, proxy_url=None):
@@ -383,7 +406,7 @@ class URLLib3Session(object):
         proxy_scheme = urlparse(proxy_url).scheme
         using_https_forwarding_proxy = (
             proxy_scheme == 'https' and
-            self._proxies_kwargs.get('use_forwarding_for_https', False)
+            self._proxies_kwargs().get('use_forwarding_for_https', False)
         )
 
         if using_https_forwarding_proxy or url.startswith('http:'):
diff --git a/docs/source/conf.py b/docs/source/conf.py
index e20e02c19..2c871e546 100644
--- a/docs/source/conf.py
+++ b/docs/source/conf.py
@@ -54,7 +54,7 @@ copyright = u'2013, Mitch Garnaat'
 # The short X.Y version.
 version = '1.24.'
 # The full version, including alpha/beta/rc tags.
-release = '1.24.33'
+release = '1.24.34'
 
 # The language for content autogenerated by Sphinx. Refer to documentation
 # for a list of supported languages.


Test patch:
diff --git a/tests/unit/test_http_session.py b/tests/unit/test_http_session.py
index cc200cfbd..6315a92cd 100644
--- a/tests/unit/test_http_session.py
+++ b/tests/unit/test_http_session.py
@@ -367,6 +367,28 @@ class TestURLLib3Session(unittest.TestCase):
             last_call = self.proxy_manager_fun.call_args[-1]
             self.assertIs(last_call['ssl_context'].check_hostname, True)
 
+    def test_proxy_ssl_context_does_not_use_check_hostname_if_ip_address(self):
+        cert = ('/some/cert', '/some/key')
+        proxies_config = {'proxy_client_cert': "path/to/cert"}
+        urls = ['https://1.2.3.4:5678',
+                'https://4.6.0.0',
+                'https://[FE80::8939:7684:D84b:a5A4%251]:1234',
+                'https://[FE80::8939:7684:D84b:a5A4%251]',
+                'https://[FE80::8939:7684:D84b:a5A4]:999',
+                'https://[FE80::8939:7684:D84b:a5A4]',
+                'https://[::1]:789']
+        for proxy_url in urls:
+            with mock.patch('botocore.httpsession.SSLContext'):
+                proxies = {'https': proxy_url}
+                session = URLLib3Session(
+                    proxies=proxies, client_cert=cert,
+                    proxies_config=proxies_config
+                )
+                self.request.url = 'https://example.com/'
+                session.send(self.request.prepare())
+                last_call = self.proxy_manager_fun.call_args[-1]
+                self.assertIs(last_call['ssl_context'].check_hostname, False)
+
     def test_basic_request(self):
         session = URLLib3Session()
         session.send(self.request.prepare())