From 6e4cdb0bbad60243fe89d37e1cc81e4e38f7b0cf Mon Sep 17 00:00:00 2001
From: Eric Beard <ericzbeard@gmail.com>
Date: Fri, 26 Jul 2024 15:32:34 -0700
Subject: [PATCH] Version bump to 1.13.1

---
 docs/index.md                                 |   2 +-
 docs/rain_bootstrap.md                        |   2 +-
 docs/rain_build.md                            |   2 +-
 docs/rain_cat.md                              |   2 +-
 docs/rain_cc.md                               |   2 +-
 docs/rain_cc_deploy.md                        |   2 +-
 docs/rain_cc_drift.md                         |   2 +-
 docs/rain_cc_rm.md                            |   2 +-
 docs/rain_cc_state.md                         |   2 +-
 docs/rain_console.md                          |   2 +-
 docs/rain_deploy.md                           |   2 +-
 docs/rain_diff.md                             |   2 +-
 docs/rain_fmt.md                              |   2 +-
 docs/rain_forecast.md                         |   2 +-
 docs/rain_info.md                             |   2 +-
 docs/rain_logs.md                             |   2 +-
 docs/rain_ls.md                               |   2 +-
 docs/rain_merge.md                            |   2 +-
 docs/rain_module.md                           |   2 +-
 docs/rain_module_bootstrap.md                 |   2 +-
 docs/rain_module_install.md                   |   2 +-
 docs/rain_module_publish.md                   |   2 +-
 docs/rain_pkg.md                              |   2 +-
 docs/rain_rm.md                               |   2 +-
 docs/rain_stackset.md                         |   2 +-
 docs/rain_stackset_deploy.md                  |   2 +-
 docs/rain_stackset_ls.md                      |   2 +-
 docs/rain_stackset_rm.md                      |   2 +-
 docs/rain_tree.md                             |   2 +-
 docs/rain_watch.md                            |   2 +-
 go.mod                                        |  16 +-
 go.sum                                        |  14 +
 .../applicationautoscaling/scalingpolicy.json |  92 +-
 .../autoshiftobservernotificationstatus.json  |  76 ++
 .../zonalautoshiftconfiguration.json          |   8 +-
 .../cfn/schemas/aws/batch/jobdefinition.json  |   3 +
 .../cfn/schemas/aws/bedrock/datasource.json   |   2 +-
 .../aws/cfn/schemas/aws/bedrock/flow.json     | 909 ++++++++++++++++++
 .../cfn/schemas/aws/bedrock/flowalias.json    | 172 ++++
 .../cfn/schemas/aws/bedrock/flowversion.json  | 786 +++++++++++++++
 .../schemas/aws/bedrock/knowledgebase.json    | 122 ++-
 .../aws/cfn/schemas/aws/bedrock/prompt.json   | 346 +++++++
 .../schemas/aws/bedrock/promptversion.json    | 288 ++++++
 .../aws/cleanroomsml/trainingdataset.json     |   6 +-
 .../aws/codeartifact/packagegroup.json        |   7 +-
 .../aws/connectcampaigns/campaign.json        |   6 +-
 .../schemas/aws/dms/replicationconfig.json    |  17 +-
 .../cfn/schemas/aws/ec2/eipassociation.json   |  14 +-
 .../aws/cfn/schemas/aws/ec2/instance.json     |   7 +-
 internal/aws/cfn/schemas/aws/ec2/keypair.json |   6 +-
 .../cfn/schemas/aws/ec2/launchtemplate.json   |  28 +-
 .../aws/ec2/networkinterfaceattachment.json   |  20 +-
 .../cfn/schemas/aws/ec2/subnetcidrblock.json  |  98 +-
 .../aws/ec2/trafficmirrorfilterrule.json      |  41 +-
 .../aws/cfn/schemas/aws/ec2/vpccidrblock.json | 172 ++--
 .../aws/cfn/schemas/aws/ecr/repository.json   |   2 +-
 .../aws/ecr/repositorycreationtemplate.json   |  12 +-
 internal/aws/cfn/schemas/aws/eks/cluster.json | 592 +++++++-----
 .../aws/cfn/schemas/aws/eks/nodegroup.json    |   6 +-
 .../entityresolution/idmappingworkflow.json   | 454 ++++-----
 internal/aws/cfn/schemas/aws/fms/policy.json  |   2 +-
 .../crossaccountattachment.json               |   6 +-
 .../aws/kinesisfirehose/deliverystream.json   | 126 +++
 .../aws/cfn/schemas/aws/lightsail/alarm.json  |   2 +-
 .../schemas/aws/lightsail/certificate.json    |   2 +-
 .../schemas/aws/mediaconnect/flowoutput.json  |   8 +
 .../schemas/aws/mediapackagev2/channel.json   |  13 +-
 .../aws/mediapackagev2/originendpoint.json    |  26 +
 .../cfn/schemas/aws/neptune/dbcluster.json    |  15 +-
 .../aws/organizations/organization.json       |   4 +-
 .../aws/cfn/schemas/aws/rds/dbcluster.json    |  17 +-
 .../aws/cfn/schemas/aws/rds/dbinstance.json   |   9 +-
 .../aws/cfn/schemas/aws/rds/integration.json  |  34 +-
 .../cfn/schemas/aws/s3outposts/bucket.json    |   7 +-
 .../aws/cfn/schemas/aws/sagemaker/app.json    |   6 +
 .../aws/cfn/schemas/aws/sagemaker/domain.json |  20 +
 .../aws/sagemaker/mlflowtrackingserver.json   | 165 ++++
 .../aws/cfn/schemas/aws/sagemaker/model.json  |  15 +
 .../aws/cfn/schemas/aws/sagemaker/space.json  |  32 +
 .../schemas/aws/sagemaker/userprofile.json    |  26 +
 .../aws/secretsmanager/resourcepolicy.json    |  68 +-
 .../schemas/aws/shield/protectiongroup.json   |   7 +-
 .../cfn/schemas/aws/workspacesweb/portal.json |   9 +-
 .../aws/workspacesweb/usersettings.json       |   3 +
 internal/aws/cfn/schemas/aws/xray/group.json  |   7 +
 .../cfn/schemas/aws/xray/samplingrule.json    |   7 +
 internal/config/version.go                    |   2 +-
 scripts/integ.sh                              |  22 +-
 88 files changed, 4222 insertions(+), 820 deletions(-)
 create mode 100644 internal/aws/cfn/schemas/aws/arczonalshift/autoshiftobservernotificationstatus.json
 create mode 100644 internal/aws/cfn/schemas/aws/bedrock/flow.json
 create mode 100644 internal/aws/cfn/schemas/aws/bedrock/flowalias.json
 create mode 100644 internal/aws/cfn/schemas/aws/bedrock/flowversion.json
 create mode 100644 internal/aws/cfn/schemas/aws/bedrock/prompt.json
 create mode 100644 internal/aws/cfn/schemas/aws/bedrock/promptversion.json
 create mode 100644 internal/aws/cfn/schemas/aws/sagemaker/mlflowtrackingserver.json

diff --git a/docs/index.md b/docs/index.md
index a174075a..80eae4b2 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -36,4 +36,4 @@ Rain is a command line tool for working with AWS CloudFormation templates and st
 * [rain tree](rain_tree.md)	 - Find dependencies of Resources and Outputs in a local template
 * [rain watch](rain_watch.md)	 - Display an updating view of a CloudFormation stack
 
-###### Auto generated by spf13/cobra on 11-Jul-2024
+###### Auto generated by spf13/cobra on 26-Jul-2024
diff --git a/docs/rain_bootstrap.md b/docs/rain_bootstrap.md
index 39cd41bf..6f18afba 100644
--- a/docs/rain_bootstrap.md
+++ b/docs/rain_bootstrap.md
@@ -30,4 +30,4 @@ rain bootstrap
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 11-Jul-2024
+###### Auto generated by spf13/cobra on 26-Jul-2024
diff --git a/docs/rain_build.md b/docs/rain_build.md
index 72bc6b7a..31ee0116 100644
--- a/docs/rain_build.md
+++ b/docs/rain_build.md
@@ -41,4 +41,4 @@ rain build [<resource type>] or <prompt>
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 11-Jul-2024
+###### Auto generated by spf13/cobra on 26-Jul-2024
diff --git a/docs/rain_cat.md b/docs/rain_cat.md
index bc93ef6c..7ca20e73 100644
--- a/docs/rain_cat.md
+++ b/docs/rain_cat.md
@@ -35,4 +35,4 @@ rain cat <stack>
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 11-Jul-2024
+###### Auto generated by spf13/cobra on 26-Jul-2024
diff --git a/docs/rain_cc.md b/docs/rain_cc.md
index c11cb8d9..f6b463eb 100644
--- a/docs/rain_cc.md
+++ b/docs/rain_cc.md
@@ -32,4 +32,4 @@ You must pass the --experimental (-x) flag to use this command, to acknowledge t
 * [rain cc rm](rain_cc_rm.md)	 - Delete a deployment created by cc deploy (Experimental!)
 * [rain cc state](rain_cc_state.md)	 - Download the state file for a template deployed with cc deploy
 
-###### Auto generated by spf13/cobra on 11-Jul-2024
+###### Auto generated by spf13/cobra on 26-Jul-2024
diff --git a/docs/rain_cc_deploy.md b/docs/rain_cc_deploy.md
index 5960fa73..dba54479 100644
--- a/docs/rain_cc_deploy.md
+++ b/docs/rain_cc_deploy.md
@@ -40,4 +40,4 @@ rain cc deploy <template> <name>
 
 * [rain cc](rain_cc.md)	 - Interact with templates using Cloud Control API instead of CloudFormation
 
-###### Auto generated by spf13/cobra on 11-Jul-2024
+###### Auto generated by spf13/cobra on 26-Jul-2024
diff --git a/docs/rain_cc_drift.md b/docs/rain_cc_drift.md
index 8d72fd7d..bee88610 100644
--- a/docs/rain_cc_drift.md
+++ b/docs/rain_cc_drift.md
@@ -33,4 +33,4 @@ rain cc drift <name>
 
 * [rain cc](rain_cc.md)	 - Interact with templates using Cloud Control API instead of CloudFormation
 
-###### Auto generated by spf13/cobra on 11-Jul-2024
+###### Auto generated by spf13/cobra on 26-Jul-2024
diff --git a/docs/rain_cc_rm.md b/docs/rain_cc_rm.md
index 4d2eac86..5d53124e 100644
--- a/docs/rain_cc_rm.md
+++ b/docs/rain_cc_rm.md
@@ -33,4 +33,4 @@ rain cc rm <name>
 
 * [rain cc](rain_cc.md)	 - Interact with templates using Cloud Control API instead of CloudFormation
 
-###### Auto generated by spf13/cobra on 11-Jul-2024
+###### Auto generated by spf13/cobra on 26-Jul-2024
diff --git a/docs/rain_cc_state.md b/docs/rain_cc_state.md
index 4d264faa..441ff877 100644
--- a/docs/rain_cc_state.md
+++ b/docs/rain_cc_state.md
@@ -33,4 +33,4 @@ rain cc state <name>
 
 * [rain cc](rain_cc.md)	 - Interact with templates using Cloud Control API instead of CloudFormation
 
-###### Auto generated by spf13/cobra on 11-Jul-2024
+###### Auto generated by spf13/cobra on 26-Jul-2024
diff --git a/docs/rain_console.md b/docs/rain_console.md
index 7285486a..42171a50 100644
--- a/docs/rain_console.md
+++ b/docs/rain_console.md
@@ -39,4 +39,4 @@ rain console [stack]
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 11-Jul-2024
+###### Auto generated by spf13/cobra on 26-Jul-2024
diff --git a/docs/rain_deploy.md b/docs/rain_deploy.md
index 79a8ba7f..362e489a 100644
--- a/docs/rain_deploy.md
+++ b/docs/rain_deploy.md
@@ -85,4 +85,4 @@ rain deploy <template> [stack]
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 11-Jul-2024
+###### Auto generated by spf13/cobra on 26-Jul-2024
diff --git a/docs/rain_diff.md b/docs/rain_diff.md
index 966bbfea..939ad82a 100644
--- a/docs/rain_diff.md
+++ b/docs/rain_diff.md
@@ -28,4 +28,4 @@ rain diff <from> <to>
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 11-Jul-2024
+###### Auto generated by spf13/cobra on 26-Jul-2024
diff --git a/docs/rain_fmt.md b/docs/rain_fmt.md
index fce1849d..2a5d117a 100644
--- a/docs/rain_fmt.md
+++ b/docs/rain_fmt.md
@@ -37,4 +37,4 @@ rain fmt <filename>...
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 11-Jul-2024
+###### Auto generated by spf13/cobra on 26-Jul-2024
diff --git a/docs/rain_forecast.md b/docs/rain_forecast.md
index 61ff14f5..3eaab090 100644
--- a/docs/rain_forecast.md
+++ b/docs/rain_forecast.md
@@ -53,4 +53,4 @@ rain forecast --experimental <template> [stackName]
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 11-Jul-2024
+###### Auto generated by spf13/cobra on 26-Jul-2024
diff --git a/docs/rain_info.md b/docs/rain_info.md
index e40365c2..d6e0f456 100644
--- a/docs/rain_info.md
+++ b/docs/rain_info.md
@@ -30,4 +30,4 @@ rain info
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 11-Jul-2024
+###### Auto generated by spf13/cobra on 26-Jul-2024
diff --git a/docs/rain_logs.md b/docs/rain_logs.md
index 47187594..be6954a5 100644
--- a/docs/rain_logs.md
+++ b/docs/rain_logs.md
@@ -37,4 +37,4 @@ rain logs <stack> (<resource>)
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 11-Jul-2024
+###### Auto generated by spf13/cobra on 26-Jul-2024
diff --git a/docs/rain_ls.md b/docs/rain_ls.md
index 7562746e..292fe3cb 100644
--- a/docs/rain_ls.md
+++ b/docs/rain_ls.md
@@ -31,4 +31,4 @@ rain ls <stack> [changeset]
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 11-Jul-2024
+###### Auto generated by spf13/cobra on 26-Jul-2024
diff --git a/docs/rain_merge.md b/docs/rain_merge.md
index c5ff3cc5..bd5b3a0c 100644
--- a/docs/rain_merge.md
+++ b/docs/rain_merge.md
@@ -29,4 +29,4 @@ rain merge <template> <template> ...
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 11-Jul-2024
+###### Auto generated by spf13/cobra on 26-Jul-2024
diff --git a/docs/rain_module.md b/docs/rain_module.md
index 4eebfd17..87b831dc 100644
--- a/docs/rain_module.md
+++ b/docs/rain_module.md
@@ -31,4 +31,4 @@ The rain module command can be used to publish modules to CodeArtifact, and to i
 * [rain module install](rain_module_install.md)	 - Install a package of Rain modules from CodeArtifact
 * [rain module publish](rain_module_publish.md)	 - Publish a directory of Rain modules to CodeArtifact
 
-###### Auto generated by spf13/cobra on 11-Jul-2024
+###### Auto generated by spf13/cobra on 26-Jul-2024
diff --git a/docs/rain_module_bootstrap.md b/docs/rain_module_bootstrap.md
index f753f8cb..be423503 100644
--- a/docs/rain_module_bootstrap.md
+++ b/docs/rain_module_bootstrap.md
@@ -29,4 +29,4 @@ rain module bootstrap [flags]
 
 * [rain module](rain_module.md)	 - Interact with Rain modules in CodeArtifact
 
-###### Auto generated by spf13/cobra on 11-Jul-2024
+###### Auto generated by spf13/cobra on 26-Jul-2024
diff --git a/docs/rain_module_install.md b/docs/rain_module_install.md
index b6fb76b9..968205f7 100644
--- a/docs/rain_module_install.md
+++ b/docs/rain_module_install.md
@@ -30,4 +30,4 @@ rain module install <name> [flags]
 
 * [rain module](rain_module.md)	 - Interact with Rain modules in CodeArtifact
 
-###### Auto generated by spf13/cobra on 11-Jul-2024
+###### Auto generated by spf13/cobra on 26-Jul-2024
diff --git a/docs/rain_module_publish.md b/docs/rain_module_publish.md
index 1f9a356f..7a529b68 100644
--- a/docs/rain_module_publish.md
+++ b/docs/rain_module_publish.md
@@ -30,4 +30,4 @@ rain module publish <name> [flags]
 
 * [rain module](rain_module.md)	 - Interact with Rain modules in CodeArtifact
 
-###### Auto generated by spf13/cobra on 11-Jul-2024
+###### Auto generated by spf13/cobra on 26-Jul-2024
diff --git a/docs/rain_pkg.md b/docs/rain_pkg.md
index 911a7739..41f17fc8 100644
--- a/docs/rain_pkg.md
+++ b/docs/rain_pkg.md
@@ -68,4 +68,4 @@ rain pkg <template>
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 11-Jul-2024
+###### Auto generated by spf13/cobra on 26-Jul-2024
diff --git a/docs/rain_rm.md b/docs/rain_rm.md
index f26a7e12..e2038b07 100644
--- a/docs/rain_rm.md
+++ b/docs/rain_rm.md
@@ -33,4 +33,4 @@ rain rm <stack> [changeset]
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 11-Jul-2024
+###### Auto generated by spf13/cobra on 26-Jul-2024
diff --git a/docs/rain_stackset.md b/docs/rain_stackset.md
index ca720d9a..680a8768 100644
--- a/docs/rain_stackset.md
+++ b/docs/rain_stackset.md
@@ -28,4 +28,4 @@ This command manipulates stack sets. It has no action if specific stack set comm
 * [rain stackset ls](rain_stackset_ls.md)	 - List a CloudFormation stack sets in a given region
 * [rain stackset rm](rain_stackset_rm.md)	 - Delete a CloudFormation stack set and/or its instances.
 
-###### Auto generated by spf13/cobra on 11-Jul-2024
+###### Auto generated by spf13/cobra on 26-Jul-2024
diff --git a/docs/rain_stackset_deploy.md b/docs/rain_stackset_deploy.md
index 8958bf97..55cfe9be 100644
--- a/docs/rain_stackset_deploy.md
+++ b/docs/rain_stackset_deploy.md
@@ -65,4 +65,4 @@ rain stackset deploy <template> [stackset] [flags]
 
 * [rain stackset](rain_stackset.md)	 - This command manipulates stack sets.
 
-###### Auto generated by spf13/cobra on 11-Jul-2024
+###### Auto generated by spf13/cobra on 26-Jul-2024
diff --git a/docs/rain_stackset_ls.md b/docs/rain_stackset_ls.md
index 822bb67e..764fd5ae 100644
--- a/docs/rain_stackset_ls.md
+++ b/docs/rain_stackset_ls.md
@@ -31,4 +31,4 @@ rain stackset ls <stack set>
 
 * [rain stackset](rain_stackset.md)	 - This command manipulates stack sets.
 
-###### Auto generated by spf13/cobra on 11-Jul-2024
+###### Auto generated by spf13/cobra on 26-Jul-2024
diff --git a/docs/rain_stackset_rm.md b/docs/rain_stackset_rm.md
index a35d2764..254d4176 100644
--- a/docs/rain_stackset_rm.md
+++ b/docs/rain_stackset_rm.md
@@ -31,4 +31,4 @@ rain stackset rm <stackset>
 
 * [rain stackset](rain_stackset.md)	 - This command manipulates stack sets.
 
-###### Auto generated by spf13/cobra on 11-Jul-2024
+###### Auto generated by spf13/cobra on 26-Jul-2024
diff --git a/docs/rain_tree.md b/docs/rain_tree.md
index ff459bdb..41077121 100644
--- a/docs/rain_tree.md
+++ b/docs/rain_tree.md
@@ -30,4 +30,4 @@ rain tree [template]
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 11-Jul-2024
+###### Auto generated by spf13/cobra on 26-Jul-2024
diff --git a/docs/rain_watch.md b/docs/rain_watch.md
index 6f575610..19dfa489 100644
--- a/docs/rain_watch.md
+++ b/docs/rain_watch.md
@@ -30,4 +30,4 @@ rain watch <stack>
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 11-Jul-2024
+###### Auto generated by spf13/cobra on 26-Jul-2024
diff --git a/go.mod b/go.mod
index 1593d3d7..4fbf74ef 100644
--- a/go.mod
+++ b/go.mod
@@ -8,11 +8,11 @@ require (
 	//github.com/ake-persson/mapslice-json v0.0.0-20210720081907-22c8edf57807
 	github.com/appscode/jsonpatch v1.0.1
 	github.com/aws/aws-sdk-go-v2 v1.30.3
-	github.com/aws/aws-sdk-go-v2/config v1.27.26
-	github.com/aws/aws-sdk-go-v2/credentials v1.17.26
-	github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.14.0
+	github.com/aws/aws-sdk-go-v2/config v1.27.27
+	github.com/aws/aws-sdk-go-v2/credentials v1.17.27
+	github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.15.0
 	github.com/aws/aws-sdk-go-v2/service/cloudformation v1.53.3
-	github.com/aws/aws-sdk-go-v2/service/ec2 v1.170.0
+	github.com/aws/aws-sdk-go-v2/service/ec2 v1.173.0
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.58.2
 	github.com/aws/aws-sdk-go-v2/service/sts v1.30.3
 	github.com/aws/smithy-go v1.20.3
@@ -34,7 +34,8 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/codeartifact v1.30.3
 	github.com/aws/aws-sdk-go-v2/service/kms v1.35.3
 	github.com/aws/aws-sdk-go-v2/service/lightsail v1.40.3
-	github.com/aws/aws-sdk-go-v2/service/rds v1.81.4
+	github.com/aws/aws-sdk-go-v2/service/rds v1.81.5
+	github.com/aws/aws-sdk-go-v2/service/sagemaker v1.151.0
 	github.com/aws/aws-sdk-go-v2/service/servicequotas v1.23.3
 	github.com/aws/aws-sdk-go-v2/service/ssm v1.52.3
 	github.com/fatih/color v1.17.0
@@ -45,7 +46,6 @@ require (
 
 require (
 	github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.15 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sagemaker v1.151.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.26.4 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
@@ -68,12 +68,12 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.3.17 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.17 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.17.15 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.22.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.22.4 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.4 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
-	golang.org/x/exp v0.0.0-20240707233637-46b078467d37
+	golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56
 	gopkg.in/yaml.v2 v2.4.0
 )
diff --git a/go.sum b/go.sum
index 014ea56a..1e7d3683 100644
--- a/go.sum
+++ b/go.sum
@@ -22,12 +22,16 @@ github.com/aws/aws-sdk-go-v2/config v1.27.21 h1:yPX3pjGCe2hJsetlmGNB4Mngu7UPmvWP
 github.com/aws/aws-sdk-go-v2/config v1.27.21/go.mod h1:4XtlEU6DzNai8RMbjSF5MgGZtYvrhBP/aKZcRtZAVdM=
 github.com/aws/aws-sdk-go-v2/config v1.27.26 h1:T1kAefbKuNum/AbShMsZEro6eRkeOT8YILfE9wyjAYQ=
 github.com/aws/aws-sdk-go-v2/config v1.27.26/go.mod h1:ivWHkAWFrw/nxty5Fku7soTIVdqZaZ7dw+tc5iGW3GA=
+github.com/aws/aws-sdk-go-v2/config v1.27.27 h1:HdqgGt1OAP0HkEDDShEl0oSYa9ZZBSOmKpdpsDMdO90=
+github.com/aws/aws-sdk-go-v2/config v1.27.27/go.mod h1:MVYamCg76dFNINkZFu4n4RjDixhVr51HLj4ErWzrVwg=
 github.com/aws/aws-sdk-go-v2/credentials v1.17.17 h1:b3Dk9uxQByS9sc6r0sc2jmxsJKO75eOcb9nNEiaUBLM=
 github.com/aws/aws-sdk-go-v2/credentials v1.17.17/go.mod h1:e4khg9iY08LnFK/HXQDWMf9GDaiMari7jWPnXvKAuBU=
 github.com/aws/aws-sdk-go-v2/credentials v1.17.21 h1:pjAqgzfgFhTv5grc7xPHtXCAaMapzmwA7aU+c/SZQGw=
 github.com/aws/aws-sdk-go-v2/credentials v1.17.21/go.mod h1:nhK6PtBlfHTUDVmBLr1dg+WHCOCK+1Fu/WQyVHPsgNQ=
 github.com/aws/aws-sdk-go-v2/credentials v1.17.26 h1:tsm8g/nJxi8+/7XyJJcP2dLrnK/5rkFp6+i2nhmz5fk=
 github.com/aws/aws-sdk-go-v2/credentials v1.17.26/go.mod h1:3vAM49zkIa3q8WT6o9Ve5Z0vdByDMwmdScO0zvThTgI=
+github.com/aws/aws-sdk-go-v2/credentials v1.17.27 h1:2raNba6gr2IfA0eqqiP2XiQ0UVOpGPgDSi0I9iAP+UI=
+github.com/aws/aws-sdk-go-v2/credentials v1.17.27/go.mod h1:gniiwbGahQByxan6YjQUMcW4Aov6bLC3m+evgcoN4r4=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.4 h1:0cSfTYYL9qiRcdi4Dvz+8s3JUgNR2qvbgZkXcwPEEEk=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.4/go.mod h1:Wjn5O9eS7uSi7vlPKt/v0MLTncANn9EMmoDvnzJli6o=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.8 h1:FR+oWPFb/8qMVYMWN98bUZAGqPvLHiyqg1wqQGfUAXY=
@@ -66,6 +70,8 @@ github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.10.1 h1:IvYkZ/7XXbEaTGCL3
 github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.10.1/go.mod h1:vHk9LI9clsbT8DYUmHtBxinKBlnp4XvxqyaCXA7J2bY=
 github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.14.0 h1:vmR922WiF3BuOG+4hliLsn5hAO43siJWqURndXrs2A0=
 github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.14.0/go.mod h1:G/STzijpkhEbwc7qAYGfTw4AxHJQWfX8PsV1RsCNQbM=
+github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.15.0 h1:wQd0mjGuP3ihFXyxfSaQOl3S/F+aT85fvX1cYQpbInw=
+github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.15.0/go.mod h1:G/STzijpkhEbwc7qAYGfTw4AxHJQWfX8PsV1RsCNQbM=
 github.com/aws/aws-sdk-go-v2/service/cloudcontrol v1.18.9 h1:Wp1QFv8uyNpwPXSI/a6TRkIR0CiT+Fa60s5vVTsFdXM=
 github.com/aws/aws-sdk-go-v2/service/cloudcontrol v1.18.9/go.mod h1:pFrHzOZRN/EfWL7ygk9ELdQHqRGERgOgP03OLIOlQV4=
 github.com/aws/aws-sdk-go-v2/service/cloudcontrol v1.19.1 h1:xje03QCAf/8b1Ntsx/QR4oTn0tMIshVT/OUAilcwcO0=
@@ -90,6 +96,8 @@ github.com/aws/aws-sdk-go-v2/service/ec2 v1.165.1 h1:LkSnU1c9JKJyXYcwpWgQGuwctwv
 github.com/aws/aws-sdk-go-v2/service/ec2 v1.165.1/go.mod h1:Wv7N3iFOKVsZNIaw9MOBUmwCkX6VMmQQRFhMrHtNGno=
 github.com/aws/aws-sdk-go-v2/service/ec2 v1.170.0 h1:zPwhEYn3Y83mnnr9QG+i6NTiAbVbcJe6RpCSJKHIQNE=
 github.com/aws/aws-sdk-go-v2/service/ec2 v1.170.0/go.mod h1:9KdiRVKTZyPRTlbX3i41FxTV+5OatZ7xOJCN4lleX7g=
+github.com/aws/aws-sdk-go-v2/service/ec2 v1.173.0 h1:ta62lid9JkIpKZtZZXSj6rP2AqY5x1qYGq53ffxqD9Q=
+github.com/aws/aws-sdk-go-v2/service/ec2 v1.173.0/go.mod h1:o6QDjdVKpP5EF0dp/VlvqckzuSDATr1rLdHt3A5m0YY=
 github.com/aws/aws-sdk-go-v2/service/iam v1.32.5 h1:G2judWqHbm2bDrmJPj9W0nD3Pv8+WzhY+fAAEQMpLf4=
 github.com/aws/aws-sdk-go-v2/service/iam v1.32.5/go.mod h1:RorjhuicJ7tEwun17BEeD//1JiPdvxPv15KOa9BKxS8=
 github.com/aws/aws-sdk-go-v2/service/iam v1.33.1 h1:0dcMo3330L9LIckl+4iujMoq0AdR8LMK0TtgrjHUi6M=
@@ -136,6 +144,8 @@ github.com/aws/aws-sdk-go-v2/service/rds v1.80.1 h1:o0DyV3AWeuAwrBVeoW/kCZJi4oGC
 github.com/aws/aws-sdk-go-v2/service/rds v1.80.1/go.mod h1:lmaCww9B42S2WBaJNa5v+HeRpoGO+9gO+SwYJtNV8mw=
 github.com/aws/aws-sdk-go-v2/service/rds v1.81.4 h1:tBtjOMKyEWLvsO6HaX6A+0A0V1gKcU2aSZKQXw6MSCM=
 github.com/aws/aws-sdk-go-v2/service/rds v1.81.4/go.mod h1:j27FNXhbbHXC3ExFsJkoxq2Y+4dQypf8KFX1IkgwVvM=
+github.com/aws/aws-sdk-go-v2/service/rds v1.81.5 h1:0vEV6OFcCInf/G98MIwwNJM21cd0g+8/jcxXNE40pJA=
+github.com/aws/aws-sdk-go-v2/service/rds v1.81.5/go.mod h1:j27FNXhbbHXC3ExFsJkoxq2Y+4dQypf8KFX1IkgwVvM=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.54.4 h1:4p9SCdZBO0PdEXLTF2fcQuxOEkEiqPQpK824cP2VKRo=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.54.4/go.mod h1:oSkRFuHVWmUY4Ssk16ErGzBqvYEbvORJFzFXzWhTB2s=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.56.1 h1:wsg9Z/vNnCmxWikfGIoOlnExtEU459cR+2d+iDJ8elo=
@@ -162,6 +172,8 @@ github.com/aws/aws-sdk-go-v2/service/sso v1.21.1 h1:sd0BsnAvLH8gsp2e3cbaIr+9D7T1
 github.com/aws/aws-sdk-go-v2/service/sso v1.21.1/go.mod h1:lcQG/MmxydijbeTOp04hIuJwXGWPZGI3bwdFDGRTv14=
 github.com/aws/aws-sdk-go-v2/service/sso v1.22.3 h1:Fv1vD2L65Jnp5QRsdiM64JvUM4Xe+E0JyVsRQKv6IeA=
 github.com/aws/aws-sdk-go-v2/service/sso v1.22.3/go.mod h1:ooyCOXjvJEsUw7x+ZDHeISPMhtwI3ZCB7ggFMcFfWLU=
+github.com/aws/aws-sdk-go-v2/service/sso v1.22.4 h1:BXx0ZIxvrJdSgSvKTZ+yRBeSqqgPM89VPlulEcl37tM=
+github.com/aws/aws-sdk-go-v2/service/sso v1.22.4/go.mod h1:ooyCOXjvJEsUw7x+ZDHeISPMhtwI3ZCB7ggFMcFfWLU=
 github.com/aws/aws-sdk-go-v2/service/ssooidc v1.24.4 h1:QMSCYDg3Iyls0KZc/dk3JtS2c1lFfqbmYO10qBPPkJk=
 github.com/aws/aws-sdk-go-v2/service/ssooidc v1.24.4/go.mod h1:MZ/PVYU/mRbmSF6WK3ybCYHjA2mig8utVokDEVLDgE0=
 github.com/aws/aws-sdk-go-v2/service/ssooidc v1.25.1 h1:1uEFNNskK/I1KoZ9Q8wJxMz5V9jyBlsiaNrM7vA3YUQ=
@@ -248,6 +260,8 @@ golang.org/x/exp v0.0.0-20240613232115-7f521ea00fb8 h1:yixxcjnhBmY0nkL253HFVIm0J
 golang.org/x/exp v0.0.0-20240613232115-7f521ea00fb8/go.mod h1:jj3sYF3dwk5D+ghuXyeI3r5MFf+NT2An6/9dOA95KSI=
 golang.org/x/exp v0.0.0-20240707233637-46b078467d37 h1:uLDX+AfeFCct3a2C7uIWBKMJIR3CJMhcgfrUAqjRK6w=
 golang.org/x/exp v0.0.0-20240707233637-46b078467d37/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY=
+golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 h1:2dVuKD2vS7b0QIHQbpyTISPd0LeHDbnYEryqj5Q1ug8=
+golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY=
 golang.org/x/sys v0.0.0-20181122145206-62eef0e2fa9b/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20220310020820-b874c991c1a5/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
diff --git a/internal/aws/cfn/schemas/aws/applicationautoscaling/scalingpolicy.json b/internal/aws/cfn/schemas/aws/applicationautoscaling/scalingpolicy.json
index b5aeb0cf..a46ba755 100644
--- a/internal/aws/cfn/schemas/aws/applicationautoscaling/scalingpolicy.json
+++ b/internal/aws/cfn/schemas/aws/applicationautoscaling/scalingpolicy.json
@@ -1,31 +1,31 @@
 {
   "typeName": "AWS::ApplicationAutoScaling::ScalingPolicy",
-  "description": "Resource Type definition for AWS::ApplicationAutoScaling::ScalingPolicy",
+  "description": "The ``AWS::ApplicationAutoScaling::ScalingPolicy`` resource defines a scaling policy that Application Auto Scaling uses to adjust the capacity of a scalable target. \n For more information, see [Target tracking scaling policies](https://docs.aws.amazon.com/autoscaling/application/userguide/application-auto-scaling-target-tracking.html) and [Step scaling policies](https://docs.aws.amazon.com/autoscaling/application/userguide/application-auto-scaling-step-scaling-policies.html) in the *Application Auto Scaling User Guide*.",
   "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-rpdk.git",
   "definitions": {
     "StepScalingPolicyConfiguration": {
-      "description": "A step scaling policy.",
+      "description": "``StepScalingPolicyConfiguration`` is a property of the [AWS::ApplicationAutoScaling::ScalingPolicy](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-applicationautoscaling-scalingpolicy.html) resource that specifies a step scaling policy configuration for Application Auto Scaling. \n For more information, see [Step scaling policies](https://docs.aws.amazon.com/autoscaling/application/userguide/application-auto-scaling-step-scaling-policies.html) in the *Application Auto Scaling User Guide*.",
       "type": "object",
       "additionalProperties": false,
       "properties": {
         "AdjustmentType": {
-          "description": "Specifies how the ScalingAdjustment value in a StepAdjustment is interpreted.",
+          "description": "Specifies whether the ``ScalingAdjustment`` value in the ``StepAdjustment`` property is an absolute number or a percentage of the current capacity.",
           "type": "string"
         },
         "Cooldown": {
-          "description": "The amount of time, in seconds, to wait for a previous scaling activity to take effect.",
+          "description": "The amount of time, in seconds, to wait for a previous scaling activity to take effect. If not specified, the default value is 300. For more information, see [Cooldown period](https://docs.aws.amazon.com/autoscaling/application/userguide/step-scaling-policy-overview.html#step-scaling-cooldown) in the *Application Auto Scaling User Guide*.",
           "type": "integer"
         },
         "MetricAggregationType": {
-          "description": "The aggregation type for the CloudWatch metrics. Valid values are Minimum, Maximum, and Average. If the aggregation type is null, the value is treated as Average",
+          "description": "The aggregation type for the CloudWatch metrics. Valid values are ``Minimum``, ``Maximum``, and ``Average``. If the aggregation type is null, the value is treated as ``Average``.",
           "type": "string"
         },
         "MinAdjustmentMagnitude": {
-          "description": "The minimum value to scale by when the adjustment type is PercentChangeInCapacity.",
+          "description": "The minimum value to scale by when the adjustment type is ``PercentChangeInCapacity``. For example, suppose that you create a step scaling policy to scale out an Amazon ECS service by 25 percent and you specify a ``MinAdjustmentMagnitude`` of 2. If the service has 4 tasks and the scaling policy is performed, 25 percent of 4 is 1. However, because you specified a ``MinAdjustmentMagnitude`` of 2, Application Auto Scaling scales out the service by 2 tasks.",
           "type": "integer"
         },
         "StepAdjustments": {
-          "description": "A set of adjustments that enable you to scale based on the size of the alarm breach.",
+          "description": "A set of adjustments that enable you to scale based on the size of the alarm breach.\n At least one step adjustment is required if you are adding a new step scaling policy configuration.",
           "type": "array",
           "uniqueItems": true,
           "insertionOrder": false,
@@ -36,7 +36,7 @@
       }
     },
     "TargetTrackingScalingPolicyConfiguration": {
-      "description": "A target tracking scaling policy.",
+      "description": "``TargetTrackingScalingPolicyConfiguration`` is a property of the [AWS::ApplicationAutoScaling::ScalingPolicy](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-applicationautoscaling-scalingpolicy.html) resource that specifies a target tracking scaling policy configuration for Application Auto Scaling. Use a target tracking scaling policy to adjust the capacity of the specified scalable target in response to actual workloads, so that resource utilization remains at or near the target utilization value. \n For more information, see [Target tracking scaling policies](https://docs.aws.amazon.com/autoscaling/application/userguide/application-auto-scaling-target-tracking.html) in the *Application Auto Scaling User Guide*.",
       "type": "object",
       "additionalProperties": false,
       "properties": {
@@ -45,7 +45,7 @@
           "$ref": "#/definitions/CustomizedMetricSpecification"
         },
         "DisableScaleIn": {
-          "description": "Indicates whether scale in by the target tracking scaling policy is disabled. If the value is true, scale in is disabled and the target tracking scaling policy won't remove capacity from the scalable target. Otherwise, scale in is enabled and the target tracking scaling policy can remove capacity from the scalable target. The default value is false.",
+          "description": "Indicates whether scale in by the target tracking scaling policy is disabled. If the value is ``true``, scale in is disabled and the target tracking scaling policy won't remove capacity from the scalable target. Otherwise, scale in is enabled and the target tracking scaling policy can remove capacity from the scalable target. The default value is ``false``.",
           "type": "boolean"
         },
         "PredefinedMetricSpecification": {
@@ -53,11 +53,11 @@
           "$ref": "#/definitions/PredefinedMetricSpecification"
         },
         "ScaleInCooldown": {
-          "description": "The amount of time, in seconds, after a scale-in activity completes before another scale-in activity can start.",
+          "description": "The amount of time, in seconds, after a scale-in activity completes before another scale-in activity can start. For more information and for default values, see [Define cooldown periods](https://docs.aws.amazon.com/autoscaling/application/userguide/target-tracking-scaling-policy-overview.html#target-tracking-cooldown) in the *Application Auto Scaling User Guide*.",
           "type": "integer"
         },
         "ScaleOutCooldown": {
-          "description": "The amount of time, in seconds, to wait for a previous scale-out activity to take effect.",
+          "description": "The amount of time, in seconds, to wait for a previous scale-out activity to take effect. For more information and for default values, see [Define cooldown periods](https://docs.aws.amazon.com/autoscaling/application/userguide/target-tracking-scaling-policy-overview.html#target-tracking-cooldown) in the *Application Auto Scaling User Guide*.",
           "type": "integer"
         },
         "TargetValue": {
@@ -70,16 +70,16 @@
       ]
     },
     "PredefinedMetricSpecification": {
-      "description": "Represents a predefined metric for a target tracking scaling policy to use with Application Auto Scaling.",
+      "description": "Contains predefined metric specification information for a target tracking scaling policy for Application Auto Scaling.\n  ``PredefinedMetricSpecification`` is a property of the [AWS::ApplicationAutoScaling::ScalingPolicy TargetTrackingScalingPolicyConfiguration](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-applicationautoscaling-scalingpolicy-targettrackingscalingpolicyconfiguration.html) property type.",
       "type": "object",
       "additionalProperties": false,
       "properties": {
         "PredefinedMetricType": {
-          "description": "The metric type. The ALBRequestCountPerTarget metric type applies only to Spot Fleets and ECS services.",
+          "description": "The metric type. The ``ALBRequestCountPerTarget`` metric type applies only to Spot fleet requests and ECS services.",
           "type": "string"
         },
         "ResourceLabel": {
-          "description": "Identifies the resource associated with the metric type. You can't specify a resource label unless the metric type is ALBRequestCountPerTarget and there is a target group attached to the Spot Fleet or ECS service.",
+          "description": "Identifies the resource associated with the metric type. You can't specify a resource label unless the metric type is ``ALBRequestCountPerTarget`` and there is a target group attached to the Spot Fleet or ECS service.\n You create the resource label by appending the final portion of the load balancer ARN and the final portion of the target group ARN into a single value, separated by a forward slash (/). The format of the resource label is:\n  ``app/my-alb/778d41231b141a0f/targetgroup/my-alb-target-group/943f017f100becff``.\n Where:\n  +  app/<load-balancer-name>/<load-balancer-id> is the final portion of the load balancer ARN\n  +  targetgroup/<target-group-name>/<target-group-id> is the final portion of the target group ARN.\n  \n To find the ARN for an Application Load Balancer, use the [DescribeLoadBalancers](https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DescribeLoadBalancers.html) API operation. To find the ARN for the target group, use the [DescribeTargetGroups](https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_DescribeTargetGroups.html) API operation.",
           "type": "string"
         }
       },
@@ -88,12 +88,12 @@
       ]
     },
     "CustomizedMetricSpecification": {
-      "description": "Represents a CloudWatch metric of your choosing for a target tracking scaling policy to use with Application Auto Scaling.",
+      "description": "Contains customized metric specification information for a target tracking scaling policy for Application Auto Scaling. \n For information about the available metrics for a service, see [services that publish CloudWatch metrics](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/aws-services-cloudwatch-metrics.html) in the *Amazon CloudWatch User Guide*.\n To create your customized metric specification:\n  +  Add values for each required parameter from CloudWatch. You can use an existing metric, or a new metric that you create. To use your own metric, you must first publish the metric to CloudWatch. For more information, see [Publish custom metrics](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/publishingMetrics.html) in the *Amazon CloudWatch User Guide*.\n  +  Choose a metric that changes proportionally with capacity. The value of the metric should increase or decrease in inverse proportion to the number of capacity units. That is, the value of the metric should decrease when capacity increases, and increase when capacity decreases. \n  \n For an example of how creating new metrics can be useful, see [Scaling based on Amazon SQS](https://docs.aws.amazon.com/autoscaling/ec2/userguide/as-using-sqs-queue.html) in the *Amazon EC2 Auto Scaling User Guide*. This topic mentions Auto Scaling groups, but the same scenario for Amazon SQS can apply to the target tracking scaling policies that you create for a Spot Fleet by using Application Auto Scaling.\n For more information about the CloudWatch terminology below, see [Amazon CloudWatch concepts](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cloudwatch_concepts.html). \n  ``CustomizedMetricSpecification`` is a property of the [AWS::ApplicationAutoScaling::ScalingPolicy TargetTrackingScalingPolicyConfiguration](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-applicationautoscaling-scalingpolicy-targettrackingscalingpolicyconfiguration.html) property type.",
       "type": "object",
       "additionalProperties": false,
       "properties": {
         "Dimensions": {
-          "description": "The dimensions of the metric.",
+          "description": "The dimensions of the metric. \n Conditional: If you published your metric with dimensions, you must specify the same dimensions in your scaling policy.",
           "type": "array",
           "uniqueItems": false,
           "insertionOrder": false,
@@ -102,7 +102,7 @@
           }
         },
         "MetricName": {
-          "description": "The name of the metric. To get the exact metric name, namespace, and dimensions, inspect the Metric object that is returned by a call to ListMetrics.",
+          "description": "The name of the metric. To get the exact metric name, namespace, and dimensions, inspect the [Metric](https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_Metric.html) object that's returned by a call to [ListMetrics](https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_ListMetrics.html).",
           "type": "string"
         },
         "Namespace": {
@@ -114,7 +114,7 @@
           "type": "string"
         },
         "Unit": {
-          "description": "The unit of the metric. For a complete list of the units that CloudWatch supports, see the MetricDatum data type in the Amazon CloudWatch API Reference.",
+          "description": "The unit of the metric. For a complete list of the units that CloudWatch supports, see the [MetricDatum](https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_MetricDatum.html) data type in the *Amazon CloudWatch API Reference*.",
           "type": "string"
         },
         "Metrics": {
@@ -129,16 +129,16 @@
       }
     },
     "TargetTrackingMetricDataQuery": {
-      "description": "The metric data to return. Also defines whether this call is returning data for one metric only, or whether it is performing a math expression on the values of returned metric statistics to create a new time series. A time series is a series of data points, each of which is associated with a timestamp.",
+      "description": "The metric data to return. Also defines whether this call is returning data for one metric only, or whether it is performing a math expression on the values of returned metric statistics to create a new time series. A time series is a series of data points, each of which is associated with a timestamp.\n You can call for a single metric or perform math expressions on multiple metrics. Any expressions used in a metric specification must eventually return a single time series.\n For more information and examples, see [Create a target tracking scaling policy for Application Auto Scaling using metric math](https://docs.aws.amazon.com/autoscaling/application/userguide/application-auto-scaling-target-tracking-metric-math.html) in the *Application Auto Scaling User Guide*.\n  ``TargetTrackingMetricDataQuery`` is a property of the [AWS::ApplicationAutoScaling::ScalingPolicy CustomizedMetricSpecification](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-applicationautoscaling-scalingpolicy-customizedmetricspecification.html) property type.",
       "type": "object",
       "additionalProperties": false,
       "properties": {
         "Expression": {
-          "description": "The math expression to perform on the returned data, if this object is performing a math expression.",
+          "description": "The math expression to perform on the returned data, if this object is performing a math expression. This expression can use the ``Id`` of the other metrics to refer to those metrics, and can also use the ``Id`` of other expressions to use the result of those expressions. \n Conditional: Within each ``TargetTrackingMetricDataQuery`` object, you must specify either ``Expression`` or ``MetricStat``, but not both.",
           "type": "string"
         },
         "Id": {
-          "description": "A short name that identifies the object's results in the response.",
+          "description": "A short name that identifies the object's results in the response. This name must be unique among all ``MetricDataQuery`` objects specified for a single scaling policy. If you are performing math expressions on this set of data, this name represents that data and can serve as a variable in the mathematical expression. The valid characters are letters, numbers, and underscores. The first character must be a lowercase letter.",
           "type": "string"
         },
         "Label": {
@@ -146,41 +146,41 @@
           "type": "string"
         },
         "ReturnData": {
-          "description": "Indicates whether to return the timestamps and raw data values of this metric.",
+          "description": "Indicates whether to return the timestamps and raw data values of this metric. \n If you use any math expressions, specify ``true`` for this value for only the final math expression that the metric specification is based on. You must specify ``false`` for ``ReturnData`` for all the other metrics and expressions used in the metric specification.\n If you are only retrieving metrics and not performing any math expressions, do not specify anything for ``ReturnData``. This sets it to its default (``true``).",
           "type": "boolean"
         },
         "MetricStat": {
-          "description": "Information about the metric data to return.",
+          "description": "Information about the metric data to return.\n Conditional: Within each ``MetricDataQuery`` object, you must specify either ``Expression`` or ``MetricStat``, but not both.",
           "$ref": "#/definitions/TargetTrackingMetricStat"
         }
       }
     },
     "TargetTrackingMetricStat": {
-      "description": "This structure defines the CloudWatch metric to return, along with the statistic, period, and unit.",
+      "description": "This structure defines the CloudWatch metric to return, along with the statistic and unit.\n  ``TargetTrackingMetricStat`` is a property of the [AWS::ApplicationAutoScaling::ScalingPolicy TargetTrackingMetricDataQuery](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-applicationautoscaling-scalingpolicy-targettrackingmetricdataquery.html) property type.\n For more information about the CloudWatch terminology below, see [Amazon CloudWatch concepts](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cloudwatch_concepts.html) in the *Amazon CloudWatch User Guide*.",
       "type": "object",
       "additionalProperties": false,
       "properties": {
         "Metric": {
-          "description": "The CloudWatch metric to return, including the metric name, namespace, and dimensions. ",
+          "description": "The CloudWatch metric to return, including the metric name, namespace, and dimensions. To get the exact metric name, namespace, and dimensions, inspect the [Metric](https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_Metric.html) object that is returned by a call to [ListMetrics](https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_ListMetrics.html).",
           "$ref": "#/definitions/TargetTrackingMetric"
         },
         "Stat": {
-          "description": "The statistic to return. It can include any CloudWatch statistic or extended statistic.",
+          "description": "The statistic to return. It can include any CloudWatch statistic or extended statistic. For a list of valid values, see the table in [Statistics](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cloudwatch_concepts.html#Statistic) in the *Amazon CloudWatch User Guide*.\n The most commonly used metric for scaling is ``Average``.",
           "type": "string"
         },
         "Unit": {
-          "description": "The unit to use for the returned data points.",
+          "description": "The unit to use for the returned data points. For a complete list of the units that CloudWatch supports, see the [MetricDatum](https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_MetricDatum.html) data type in the *Amazon CloudWatch API Reference*.",
           "type": "string"
         }
       }
     },
     "TargetTrackingMetric": {
-      "description": "Represents a specific metric.",
+      "description": "Represents a specific metric for a target tracking scaling policy for Application Auto Scaling.\n Metric is a property of the [AWS::ApplicationAutoScaling::ScalingPolicy TargetTrackingMetricStat](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-applicationautoscaling-scalingpolicy-targettrackingmetricstat.html) property type.",
       "type": "object",
       "additionalProperties": false,
       "properties": {
         "Dimensions": {
-          "description": "The dimensions for the metric.",
+          "description": "The dimensions for the metric. For the list of available dimensions, see the AWS documentation available from the table in [services that publish CloudWatch metrics](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/aws-services-cloudwatch-metrics.html) in the *Amazon CloudWatch User Guide*. \n Conditional: If you published your metric with dimensions, you must specify the same dimensions in your scaling policy.",
           "type": "array",
           "uniqueItems": false,
           "insertionOrder": false,
@@ -193,13 +193,13 @@
           "type": "string"
         },
         "Namespace": {
-          "description": "The namespace of the metric.",
+          "description": "The namespace of the metric. For more information, see the table in [services that publish CloudWatch metrics](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/aws-services-cloudwatch-metrics.html) in the *Amazon CloudWatch User Guide*.",
           "type": "string"
         }
       }
     },
     "TargetTrackingMetricDimension": {
-      "description": "Describes the dimension of a metric.",
+      "description": "``TargetTrackingMetricDimension`` specifies a name/value pair that is part of the identity of a CloudWatch metric for the ``Dimensions`` property of the [AWS::ApplicationAutoScaling::ScalingPolicy TargetTrackingMetric](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-applicationautoscaling-scalingpolicy-targettrackingmetric.html) property type. Duplicate dimensions are not allowed.",
       "type": "object",
       "additionalProperties": false,
       "properties": {
@@ -214,20 +214,20 @@
       }
     },
     "StepAdjustment": {
-      "description": "Represents a step adjustment for a StepScalingPolicyConfiguration. Describes an adjustment based on the difference between the value of the aggregated CloudWatch metric and the breach threshold that you've defined for the alarm.",
+      "description": "``StepAdjustment`` specifies a step adjustment for the ``StepAdjustments`` property of the [AWS::ApplicationAutoScaling::ScalingPolicy StepScalingPolicyConfiguration](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-applicationautoscaling-scalingpolicy-stepscalingpolicyconfiguration.html) property type. \n For the following examples, suppose that you have an alarm with a breach threshold of 50: \n  +  To trigger a step adjustment when the metric is greater than or equal to 50 and less than 60, specify a lower bound of 0 and an upper bound of 10. \n  +  To trigger a step adjustment when the metric is greater than 40 and less than or equal to 50, specify a lower bound of -10 and an upper bound of 0. \n  \n For more information, see [Step adjustments](https://docs.aws.amazon.com/autoscaling/application/userguide/application-auto-scaling-step-scaling-policies.html#as-scaling-steps) in the *Application Auto Scaling User Guide*.\n You can find a sample template snippet in the [Examples](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-applicationautoscaling-scalingpolicy.html#aws-resource-applicationautoscaling-scalingpolicy--examples) section of the ``AWS::ApplicationAutoScaling::ScalingPolicy`` documentation.",
       "type": "object",
       "additionalProperties": false,
       "properties": {
         "MetricIntervalLowerBound": {
-          "description": "The lower bound for the difference between the alarm threshold and the CloudWatch metric. If the metric value is above the breach threshold, the lower bound is inclusive (the metric must be greater than or equal to the threshold plus the lower bound). Otherwise, it is exclusive (the metric must be greater than the threshold plus the lower bound). A null value indicates negative infinity.",
+          "description": "The lower bound for the difference between the alarm threshold and the CloudWatch metric. If the metric value is above the breach threshold, the lower bound is inclusive (the metric must be greater than or equal to the threshold plus the lower bound). Otherwise, it is exclusive (the metric must be greater than the threshold plus the lower bound). A null value indicates negative infinity.\n You must specify at least one upper or lower bound.",
           "type": "number"
         },
         "MetricIntervalUpperBound": {
-          "description": "The upper bound for the difference between the alarm threshold and the CloudWatch metric. If the metric value is above the breach threshold, the upper bound is exclusive (the metric must be less than the threshold plus the upper bound). Otherwise, it is inclusive (the metric must be less than or equal to the threshold plus the upper bound). A null value indicates positive infinity.",
+          "description": "The upper bound for the difference between the alarm threshold and the CloudWatch metric. If the metric value is above the breach threshold, the upper bound is exclusive (the metric must be less than the threshold plus the upper bound). Otherwise, it is inclusive (the metric must be less than or equal to the threshold plus the upper bound). A null value indicates positive infinity.\n You must specify at least one upper or lower bound.",
           "type": "number"
         },
         "ScalingAdjustment": {
-          "description": "The amount by which to scale, based on the specified adjustment type. A positive value adds to the current capacity while a negative number removes from the current capacity. For exact capacity, you must specify a positive value.",
+          "description": "The amount by which to scale. The adjustment is based on the value that you specified in the ``AdjustmentType`` property (either an absolute number or a percentage). A positive value adds to the current capacity and a negative number subtracts from the current capacity.",
           "type": "integer"
         }
       },
@@ -236,7 +236,7 @@
       ]
     },
     "MetricDimension": {
-      "description": "Describes the dimension names and values associated with a metric.",
+      "description": "``MetricDimension`` specifies a name/value pair that is part of the identity of a CloudWatch metric for the ``Dimensions`` property of the [AWS::ApplicationAutoScaling::ScalingPolicy CustomizedMetricSpecification](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-applicationautoscaling-scalingpolicy-customizedmetricspecification.html) property type. Duplicate dimensions are not allowed.",
       "type": "object",
       "additionalProperties": false,
       "properties": {
@@ -257,27 +257,31 @@
   },
   "properties": {
     "PolicyName": {
-      "description": "The name of the scaling policy.\n\nUpdates to the name of a target tracking scaling policy are not supported, unless you also update the metric used for scaling. To change only a target tracking scaling policy's name, first delete the policy by removing the existing AWS::ApplicationAutoScaling::ScalingPolicy resource from the template and updating the stack. Then, recreate the resource with the same settings and a different name.",
+      "description": "The name of the scaling policy.\n Updates to the name of a target tracking scaling policy are not supported, unless you also update the metric used for scaling. To change only a target tracking scaling policy's name, first delete the policy by removing the existing ``AWS::ApplicationAutoScaling::ScalingPolicy`` resource from the template and updating the stack. Then, recreate the resource with the same settings and a different name.",
       "type": "string"
     },
     "PolicyType": {
-      "description": "The scaling policy type.\n\nThe following policy types are supported:\n\nTargetTrackingScaling Not supported for Amazon EMR\n\nStepScaling Not supported for DynamoDB, Amazon Comprehend, Lambda, Amazon Keyspaces, Amazon MSK, Amazon ElastiCache, or Neptune.",
+      "description": "The scaling policy type.\n The following policy types are supported: \n  ``TargetTrackingScaling``?Not supported for Amazon EMR\n  ``StepScaling``?Not supported for DynamoDB, Amazon Comprehend, Lambda, Amazon Keyspaces, Amazon MSK, Amazon ElastiCache, or Neptune.",
       "type": "string"
     },
     "ResourceId": {
-      "description": "The identifier of the resource associated with the scaling policy. This string consists of the resource type and unique identifier.",
+      "description": "The identifier of the resource associated with the scaling policy. This string consists of the resource type and unique identifier.\n  +  ECS service - The resource type is ``service`` and the unique identifier is the cluster name and service name. Example: ``service/my-cluster/my-service``.\n  +  Spot Fleet - The resource type is ``spot-fleet-request`` and the unique identifier is the Spot Fleet request ID. Example: ``spot-fleet-request/sfr-73fbd2ce-aa30-494c-8788-1cee4EXAMPLE``.\n  +  EMR cluster - The resource type is ``instancegroup`` and the unique identifier is the cluster ID and instance group ID. Example: ``instancegroup/j-2EEZNYKUA1NTV/ig-1791Y4E1L8YI0``.\n  +  AppStream 2.0 fleet - The resource type is ``fleet`` and the unique identifier is the fleet name. Example: ``fleet/sample-fleet``.\n  +  DynamoDB table - The resource type is ``table`` and the unique identifier is the table name. Example: ``table/my-table``.\n  +  DynamoDB global secondary index - The resource type is ``index`` and the unique identifier is the index name. Example: ``table/my-table/index/my-table-index``.\n  +  Aurora DB cluster - The resource type is ``cluster`` and the unique identifier is the cluster name. Example: ``cluster:my-db-cluster``.\n  +  SageMaker endpoint variant - The resource type is ``variant`` and the unique identifier is the resource ID. Example: ``endpoint/my-end-point/variant/KMeansClustering``.\n  +  Custom resources are not supported with a resource type. This parameter must specify the ``OutputValue`` from the CloudFormation template stack used to access the resources. The unique identifier is defined by the service provider. More information is available in our [GitHub repository](https://docs.aws.amazon.com/https://github.com/aws/aws-auto-scaling-custom-resource).\n  +  Amazon Comprehend document classification endpoint - The resource type and unique identifier are specified using the endpoint ARN. Example: ``arn:aws:comprehend:us-west-2:123456789012:document-classifier-endpoint/EXAMPLE``.\n  +  Amazon Comprehend entity recognizer endpoint - The resource type and unique identifier are specified using the endpoint ARN. Example: ``arn:aws:comprehend:us-west-2:123456789012:entity-recognizer-endpoint/EXAMPLE``.\n  +  Lambda provisioned concurrency - The resource type is ``function`` and the unique identifier is the function name with a function version or alias name suffix that is not ``$LATEST``. Example: ``function:my-function:prod`` or ``function:my-function:1``.\n  +  Amazon Keyspaces table - The resource type is ``table`` and the unique identifier is the table name. Example: ``keyspace/mykeyspace/table/mytable``.\n  +  Amazon MSK cluster - The resource type and unique identifier are specified using the cluster ARN. Example: ``arn:aws:kafka:us-east-1:123456789012:cluster/demo-cluster-1/6357e0b2-0e6a-4b86-a0b4-70df934c2e31-5``.\n  +  Amazon ElastiCache replication group - The resource type is ``replication-group`` and the unique identifier is the replication group name. Example: ``replication-group/mycluster``.\n  +  Neptune cluster - The resource type is ``cluster`` and the unique identifier is the cluster name. Example: ``cluster:mycluster``.\n  +  SageMaker serverless endpoint - The resource type is ``variant`` and the unique identifier is the resource ID. Example: ``endpoint/my-end-point/variant/KMeansClustering``.\n  +  SageMaker inference component - The resource type is ``inference-component`` and the unique identifier is the resource ID. Example: ``inference-component/my-inference-component``.\n  +  Pool of WorkSpaces - The resource type is ``workspacespool`` and the unique identifier is the pool ID. Example: ``workspacespool/wspool-123456``.",
       "type": "string"
     },
     "ScalableDimension": {
-      "description": "The scalable dimension. This string consists of the service namespace, resource type, and scaling property.",
+      "description": "The scalable dimension. This string consists of the service namespace, resource type, and scaling property.\n  +   ``ecs:service:DesiredCount`` - The task count of an ECS service.\n  +   ``elasticmapreduce:instancegroup:InstanceCount`` - The instance count of an EMR Instance Group.\n  +   ``ec2:spot-fleet-request:TargetCapacity`` - The target capacity of a Spot Fleet.\n  +   ``appstream:fleet:DesiredCapacity`` - The capacity of an AppStream 2.0 fleet.\n  +   ``dynamodb:table:ReadCapacityUnits`` - The provisioned read capacity for a DynamoDB table.\n  +   ``dynamodb:table:WriteCapacityUnits`` - The provisioned write capacity for a DynamoDB table.\n  +   ``dynamodb:index:ReadCapacityUnits`` - The provisioned read capacity for a DynamoDB global secondary index.\n  +   ``dynamodb:index:WriteCapacityUnits`` - The provisioned write capacity for a DynamoDB global secondary index.\n  +   ``rds:cluster:ReadReplicaCount`` - The count of Aurora Replicas in an Aurora DB cluster. Available for Aurora MySQL-compatible edition and Aurora PostgreSQL-compatible edition.\n  +   ``sagemaker:variant:DesiredInstanceCount`` - The number of EC2 instances for a SageMaker model endpoint variant.\n  +   ``custom-resource:ResourceType:Property`` - The scalable dimension for a custom resource provided by your own application or service.\n  +   ``comprehend:document-classifier-endpoint:DesiredInferenceUnits`` - The number of inference units for an Amazon Comprehend document classification endpoint.\n  +   ``comprehend:entity-recognizer-endpoint:DesiredInferenceUnits`` - The number of inference units for an Amazon Comprehend entity recognizer endpoint.\n  +   ``lambda:function:ProvisionedConcurrency`` - The provisioned concurrency for a Lambda function.\n  +   ``cassandra:table:ReadCapacityUnits`` - The provisioned read capacity for an Amazon Keyspaces table.\n  +   ``cassandra:table:WriteCapacityUnits`` - The provisioned write capacity for an Amazon Keyspaces table.\n  +   ``kafka:broker-storage:VolumeSize`` - The provisioned volume size (in GiB) for brokers in an Amazon MSK cluster.\n  +   ``elasticache:replication-group:NodeGroups`` - The number of node groups for an Amazon ElastiCache replication group.\n  +   ``elasticache:replication-group:Replicas`` - The number of replicas per node group for an Amazon ElastiCache replication group.\n  +   ``neptune:cluster:ReadReplicaCount`` - The count of read replicas in an Amazon Neptune DB cluster.\n  +   ``sagemaker:variant:DesiredProvisionedConcurrency`` - The provisioned concurrency for a SageMaker serverless endpoint.\n  +   ``sagemaker:inference-component:DesiredCopyCount`` - The number of copies across an endpoint for a SageMaker inference component.\n  +   ``workspaces:workspacespool:DesiredUserSessions`` - The number of user sessions for the WorkSpaces in the pool.",
       "type": "string"
     },
     "ScalingTargetId": {
-      "description": "The CloudFormation-generated ID of an Application Auto Scaling scalable target. For more information about the ID, see the Return Value section of the AWS::ApplicationAutoScaling::ScalableTarget resource.",
-      "type": "string"
+      "description": "The CloudFormation-generated ID of an Application Auto Scaling scalable target. For more information about the ID, see the Return Value section of the ``AWS::ApplicationAutoScaling::ScalableTarget`` resource.\n  You must specify either the ``ScalingTargetId`` property, or the ``ResourceId``, ``ScalableDimension``, and ``ServiceNamespace`` properties, but not both.",
+      "type": "string",
+      "relationshipRef": {
+        "typeName": "AWS::ApplicationAutoScaling::ScalableTarget",
+        "propertyPath": "/properties/Id"
+      }
     },
     "ServiceNamespace": {
-      "description": "The namespace of the AWS service that provides the resource, or a custom-resource.",
+      "description": "The namespace of the AWS service that provides the resource, or a ``custom-resource``.",
       "type": "string"
     },
     "StepScalingPolicyConfiguration": {
@@ -289,7 +293,7 @@
       "$ref": "#/definitions/TargetTrackingScalingPolicyConfiguration"
     },
     "Arn": {
-      "description": "ARN is a read only property for the resource.",
+      "description": "",
       "type": "string"
     }
   },
diff --git a/internal/aws/cfn/schemas/aws/arczonalshift/autoshiftobservernotificationstatus.json b/internal/aws/cfn/schemas/aws/arczonalshift/autoshiftobservernotificationstatus.json
new file mode 100644
index 00000000..02650874
--- /dev/null
+++ b/internal/aws/cfn/schemas/aws/arczonalshift/autoshiftobservernotificationstatus.json
@@ -0,0 +1,76 @@
+{
+  "typeName": "AWS::ARCZonalShift::AutoshiftObserverNotificationStatus",
+  "description": "Definition of AWS::ARCZonalShift::AutoshiftObserverNotificationStatus Resource Type",
+  "definitions": {
+    "AccountId": {
+      "description": "User account id, used as part of the primary identifier for the resource",
+      "type": "string",
+      "pattern": "^\\d{12}$"
+    },
+    "Region": {
+      "description": "Region, used as part of the primary identifier for the resource",
+      "type": "string",
+      "pattern": "^[a-z0-9-]*$",
+      "maxLength": 30,
+      "minLength": 5
+    },
+    "AutoshiftObserverNotificationStatus": {
+      "type": "string",
+      "enum": [
+        "ENABLED"
+      ]
+    }
+  },
+  "properties": {
+    "Status": {
+      "$ref": "#/definitions/AutoshiftObserverNotificationStatus"
+    },
+    "AccountId": {
+      "$ref": "#/definitions/AccountId"
+    },
+    "Region": {
+      "$ref": "#/definitions/Region"
+    }
+  },
+  "readOnlyProperties": [
+    "/properties/AccountId",
+    "/properties/Region"
+  ],
+  "primaryIdentifier": [
+    "/properties/AccountId",
+    "/properties/Region"
+  ],
+  "createOnlyProperties": [
+    "/properties/Status"
+  ],
+  "required": [
+    "Status"
+  ],
+  "handlers": {
+    "create": {
+      "permissions": [
+        "arc-zonal-shift:UpdateAutoshiftObserverNotificationStatus"
+      ]
+    },
+    "read": {
+      "permissions": [
+        "arc-zonal-shift:GetAutoshiftObserverNotificationStatus"
+      ]
+    },
+    "delete": {
+      "permissions": [
+        "arc-zonal-shift:UpdateAutoshiftObserverNotificationStatus",
+        "arc-zonal-shift:GetAutoshiftObserverNotificationStatus"
+      ]
+    },
+    "list": {
+      "permissions": [
+        "arc-zonal-shift:GetAutoshiftObserverNotificationStatus"
+      ]
+    }
+  },
+  "additionalProperties": false,
+  "tagging": {
+    "taggable": false
+  }
+}
diff --git a/internal/aws/cfn/schemas/aws/arczonalshift/zonalautoshiftconfiguration.json b/internal/aws/cfn/schemas/aws/arczonalshift/zonalautoshiftconfiguration.json
index d71f13b6..75636f91 100644
--- a/internal/aws/cfn/schemas/aws/arczonalshift/zonalautoshiftconfiguration.json
+++ b/internal/aws/cfn/schemas/aws/arczonalshift/zonalautoshiftconfiguration.json
@@ -18,7 +18,7 @@
           "type": "string",
           "maxLength": 1024,
           "minLength": 8,
-          "pattern": "^arn:.*$"
+          "pattern": "^.*$"
         }
       },
       "required": [
@@ -29,9 +29,9 @@
     },
     "ControlConditionType": {
       "type": "string",
-      "enum": [
-        "CLOUDWATCH"
-      ]
+      "minLength": 8,
+      "maxLength": 10,
+      "pattern": "^[a-zA-Z]*$"
     },
     "PracticeRunConfiguration": {
       "type": "object",
diff --git a/internal/aws/cfn/schemas/aws/batch/jobdefinition.json b/internal/aws/cfn/schemas/aws/batch/jobdefinition.json
index fac92ef2..55585868 100644
--- a/internal/aws/cfn/schemas/aws/batch/jobdefinition.json
+++ b/internal/aws/cfn/schemas/aws/batch/jobdefinition.json
@@ -65,6 +65,9 @@
             "type": "string"
           }
         },
+        "EksProperties": {
+          "$ref": "#/definitions/EksProperties"
+        },
         "TargetNodes": {
           "type": "string"
         },
diff --git a/internal/aws/cfn/schemas/aws/bedrock/datasource.json b/internal/aws/cfn/schemas/aws/bedrock/datasource.json
index 0bbcbde5..97493fed 100644
--- a/internal/aws/cfn/schemas/aws/bedrock/datasource.json
+++ b/internal/aws/cfn/schemas/aws/bedrock/datasource.json
@@ -231,7 +231,7 @@
   ],
   "tagging": {
     "taggable": false,
-    "cloudFormationSystemTags": true
+    "cloudFormationSystemTags": false
   },
   "handlers": {
     "create": {
diff --git a/internal/aws/cfn/schemas/aws/bedrock/flow.json b/internal/aws/cfn/schemas/aws/bedrock/flow.json
new file mode 100644
index 00000000..24927b42
--- /dev/null
+++ b/internal/aws/cfn/schemas/aws/bedrock/flow.json
@@ -0,0 +1,909 @@
+{
+  "typeName": "AWS::Bedrock::Flow",
+  "description": "Definition of AWS::Bedrock::Flow Resource Type",
+  "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-bedrock-flows",
+  "definitions": {
+    "ConditionFlowNodeConfiguration": {
+      "type": "object",
+      "description": "Condition flow node configuration",
+      "properties": {
+        "Conditions": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/FlowCondition"
+          },
+          "maxItems": 5,
+          "minItems": 1,
+          "description": "List of conditions in a condition node",
+          "insertionOrder": true
+        }
+      },
+      "required": [
+        "Conditions"
+      ],
+      "additionalProperties": false
+    },
+    "FlowCondition": {
+      "type": "object",
+      "description": "Condition branch for a condition node",
+      "properties": {
+        "Name": {
+          "type": "string",
+          "pattern": "^[a-zA-Z]([_]?[0-9a-zA-Z]){1,50}$",
+          "description": "Name of a condition in a flow"
+        },
+        "Expression": {
+          "type": "string",
+          "maxLength": 64,
+          "minLength": 1,
+          "description": "Expression for a condition in a flow"
+        }
+      },
+      "required": [
+        "Name"
+      ],
+      "additionalProperties": false
+    },
+    "FlowConditionalConnectionConfiguration": {
+      "type": "object",
+      "description": "Conditional connection configuration",
+      "properties": {
+        "Condition": {
+          "type": "string",
+          "pattern": "^[a-zA-Z]([_]?[0-9a-zA-Z]){1,50}$",
+          "description": "Name of a condition in a flow"
+        }
+      },
+      "required": [
+        "Condition"
+      ],
+      "additionalProperties": false
+    },
+    "FlowConnection": {
+      "type": "object",
+      "description": "Flow connection",
+      "properties": {
+        "Type": {
+          "$ref": "#/definitions/FlowConnectionType"
+        },
+        "Name": {
+          "type": "string",
+          "pattern": "^[a-zA-Z]([_]?[0-9a-zA-Z]){1,100}$",
+          "description": "Name of a connection in a flow"
+        },
+        "Source": {
+          "type": "string",
+          "pattern": "^[a-zA-Z]([_]?[0-9a-zA-Z]){1,50}$",
+          "description": "Name of a node in a flow"
+        },
+        "Target": {
+          "type": "string",
+          "pattern": "^[a-zA-Z]([_]?[0-9a-zA-Z]){1,50}$",
+          "description": "Name of a node in a flow"
+        },
+        "Configuration": {
+          "$ref": "#/definitions/FlowConnectionConfiguration"
+        }
+      },
+      "required": [
+        "Name",
+        "Source",
+        "Target",
+        "Type"
+      ],
+      "additionalProperties": false
+    },
+    "FlowConnectionConfiguration": {
+      "description": "Connection configuration",
+      "oneOf": [
+        {
+          "type": "object",
+          "title": "Data",
+          "properties": {
+            "Data": {
+              "$ref": "#/definitions/FlowDataConnectionConfiguration"
+            }
+          },
+          "required": [
+            "Data"
+          ],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "title": "Conditional",
+          "properties": {
+            "Conditional": {
+              "$ref": "#/definitions/FlowConditionalConnectionConfiguration"
+            }
+          },
+          "required": [
+            "Conditional"
+          ],
+          "additionalProperties": false
+        }
+      ]
+    },
+    "FlowConnectionType": {
+      "type": "string",
+      "description": "Connection type",
+      "enum": [
+        "Data",
+        "Conditional"
+      ]
+    },
+    "FlowDataConnectionConfiguration": {
+      "type": "object",
+      "description": "Data connection configuration",
+      "properties": {
+        "SourceOutput": {
+          "type": "string",
+          "pattern": "^[a-zA-Z]([_]?[0-9a-zA-Z]){1,50}$",
+          "description": "Name of a node output in a flow"
+        },
+        "TargetInput": {
+          "type": "string",
+          "pattern": "^[a-zA-Z]([_]?[0-9a-zA-Z]){1,50}$",
+          "description": "Name of a node input in a flow"
+        }
+      },
+      "required": [
+        "SourceOutput",
+        "TargetInput"
+      ],
+      "additionalProperties": false
+    },
+    "FlowDefinition": {
+      "type": "object",
+      "description": "Flow definition",
+      "properties": {
+        "Nodes": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/FlowNode"
+          },
+          "maxItems": 20,
+          "description": "List of nodes in a flow",
+          "insertionOrder": true
+        },
+        "Connections": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/FlowConnection"
+          },
+          "maxItems": 20,
+          "description": "List of connections",
+          "insertionOrder": true
+        }
+      },
+      "additionalProperties": false
+    },
+    "FlowNode": {
+      "type": "object",
+      "description": "Internal mixin for flow node",
+      "properties": {
+        "Name": {
+          "type": "string",
+          "pattern": "^[a-zA-Z]([_]?[0-9a-zA-Z]){1,50}$",
+          "description": "Name of a node in a flow"
+        },
+        "Type": {
+          "$ref": "#/definitions/FlowNodeType"
+        },
+        "Configuration": {
+          "$ref": "#/definitions/FlowNodeConfiguration"
+        },
+        "Inputs": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/FlowNodeInput"
+          },
+          "maxItems": 5,
+          "description": "List of node inputs in a flow",
+          "insertionOrder": true
+        },
+        "Outputs": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/FlowNodeOutput"
+          },
+          "maxItems": 5,
+          "description": "List of node outputs in a flow",
+          "insertionOrder": true
+        }
+      },
+      "required": [
+        "Name",
+        "Type"
+      ],
+      "additionalProperties": false
+    },
+    "FlowNodeConfiguration": {
+      "description": "Node configuration in a flow",
+      "oneOf": [
+        {
+          "type": "object",
+          "title": "Input",
+          "properties": {
+            "Input": {
+              "$ref": "#/definitions/InputFlowNodeConfiguration"
+            }
+          },
+          "required": [
+            "Input"
+          ],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "title": "Output",
+          "properties": {
+            "Output": {
+              "$ref": "#/definitions/OutputFlowNodeConfiguration"
+            }
+          },
+          "required": [
+            "Output"
+          ],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "title": "KnowledgeBase",
+          "properties": {
+            "KnowledgeBase": {
+              "$ref": "#/definitions/KnowledgeBaseFlowNodeConfiguration"
+            }
+          },
+          "required": [
+            "KnowledgeBase"
+          ],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "title": "Condition",
+          "properties": {
+            "Condition": {
+              "$ref": "#/definitions/ConditionFlowNodeConfiguration"
+            }
+          },
+          "required": [
+            "Condition"
+          ],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "title": "Lex",
+          "properties": {
+            "Lex": {
+              "$ref": "#/definitions/LexFlowNodeConfiguration"
+            }
+          },
+          "required": [
+            "Lex"
+          ],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "title": "Prompt",
+          "properties": {
+            "Prompt": {
+              "$ref": "#/definitions/PromptFlowNodeConfiguration"
+            }
+          },
+          "required": [
+            "Prompt"
+          ],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "title": "LambdaFunction",
+          "properties": {
+            "LambdaFunction": {
+              "$ref": "#/definitions/LambdaFunctionFlowNodeConfiguration"
+            }
+          },
+          "required": [
+            "LambdaFunction"
+          ],
+          "additionalProperties": false
+        }
+      ]
+    },
+    "FlowNodeIODataType": {
+      "type": "string",
+      "description": "Type of input/output for a node in a flow",
+      "enum": [
+        "String",
+        "Number",
+        "Boolean",
+        "Object",
+        "Array"
+      ]
+    },
+    "FlowNodeInput": {
+      "type": "object",
+      "description": "Input to a node in a flow",
+      "properties": {
+        "Name": {
+          "type": "string",
+          "pattern": "^[a-zA-Z]([_]?[0-9a-zA-Z]){1,50}$",
+          "description": "Name of a node input in a flow"
+        },
+        "Type": {
+          "$ref": "#/definitions/FlowNodeIODataType"
+        },
+        "Expression": {
+          "type": "string",
+          "maxLength": 64,
+          "minLength": 1,
+          "description": "Expression for a node input in a flow"
+        }
+      },
+      "required": [
+        "Expression",
+        "Name",
+        "Type"
+      ],
+      "additionalProperties": false
+    },
+    "FlowNodeOutput": {
+      "type": "object",
+      "description": "Output of a node in a flow",
+      "properties": {
+        "Name": {
+          "type": "string",
+          "pattern": "^[a-zA-Z]([_]?[0-9a-zA-Z]){1,50}$",
+          "description": "Name of a node output in a flow"
+        },
+        "Type": {
+          "$ref": "#/definitions/FlowNodeIODataType"
+        }
+      },
+      "required": [
+        "Name",
+        "Type"
+      ],
+      "additionalProperties": false
+    },
+    "FlowNodeType": {
+      "type": "string",
+      "description": "Flow node types",
+      "enum": [
+        "Input",
+        "Output",
+        "KnowledgeBase",
+        "Condition",
+        "Lex",
+        "Prompt",
+        "LambdaFunction"
+      ]
+    },
+    "FlowStatus": {
+      "type": "string",
+      "description": "Schema Type for Flow APIs",
+      "enum": [
+        "Failed",
+        "Prepared",
+        "Preparing",
+        "NotPrepared"
+      ]
+    },
+    "InputFlowNodeConfiguration": {
+      "type": "object",
+      "description": "Input flow node configuration",
+      "additionalProperties": false
+    },
+    "KnowledgeBaseFlowNodeConfiguration": {
+      "type": "object",
+      "description": "Knowledge base flow node configuration",
+      "properties": {
+        "KnowledgeBaseId": {
+          "type": "string",
+          "maxLength": 10,
+          "pattern": "^[0-9a-zA-Z]+$",
+          "description": "Identifier of the KnowledgeBase"
+        },
+        "ModelId": {
+          "type": "string",
+          "maxLength": 2048,
+          "minLength": 1,
+          "pattern": "^arn:aws(-[^:]+)?:bedrock:[a-z0-9-]{1,20}:(([0-9]{12}:custom-model/[a-z0-9-]{1,63}[.]{1}[a-z0-9-]{1,63}(([:][a-z0-9-]{1,63}){0,2})?/[a-z0-9]{12})|(:foundation-model/([a-z0-9-]{1,63}[.]{1}[a-z0-9-]{1,63}([.]?[a-z0-9-]{1,63})([:][a-z0-9-]{1,63}){0,2})))|(([a-z0-9-]{1,63}[.]{1}[a-z0-9-]{1,63}([.]?[a-z0-9-]{1,63})([:][a-z0-9-]{1,63}){0,2}))|(([0-9a-zA-Z][_-]?)+)$",
+          "description": "ARN or name of a Bedrock model."
+        }
+      },
+      "required": [
+        "KnowledgeBaseId"
+      ],
+      "additionalProperties": false
+    },
+    "LambdaFunctionFlowNodeConfiguration": {
+      "type": "object",
+      "description": "Lambda function flow node configuration",
+      "properties": {
+        "LambdaArn": {
+          "type": "string",
+          "maxLength": 2048,
+          "pattern": "^arn:(aws[a-zA-Z-]*)?:lambda:[a-z]{2}(-gov)?-[a-z]+-\\d{1}:\\d{12}:function:[a-zA-Z0-9-_\\.]+(:(\\$LATEST|[a-zA-Z0-9-_]+))?$",
+          "description": "ARN of a Lambda."
+        }
+      },
+      "required": [
+        "LambdaArn"
+      ],
+      "additionalProperties": false
+    },
+    "LexFlowNodeConfiguration": {
+      "type": "object",
+      "description": "Lex flow node configuration",
+      "properties": {
+        "BotAliasArn": {
+          "type": "string",
+          "maxLength": 78,
+          "pattern": "^arn:aws(|-us-gov):lex:[a-z]{2}(-gov)?-[a-z]+-\\d{1}:\\d{12}:bot-alias/[0-9a-zA-Z]+/[0-9a-zA-Z]+$",
+          "description": "ARN of a Lex bot alias"
+        },
+        "LocaleId": {
+          "type": "string",
+          "maxLength": 10,
+          "minLength": 1,
+          "description": "Lex bot locale id"
+        }
+      },
+      "required": [
+        "BotAliasArn",
+        "LocaleId"
+      ],
+      "additionalProperties": false
+    },
+    "OutputFlowNodeConfiguration": {
+      "type": "object",
+      "description": "Output flow node configuration",
+      "additionalProperties": false
+    },
+    "PromptFlowNodeConfiguration": {
+      "type": "object",
+      "description": "Prompt flow node configuration",
+      "properties": {
+        "SourceConfiguration": {
+          "$ref": "#/definitions/PromptFlowNodeSourceConfiguration"
+        }
+      },
+      "required": [
+        "SourceConfiguration"
+      ],
+      "additionalProperties": false
+    },
+    "PromptFlowNodeInlineConfiguration": {
+      "type": "object",
+      "description": "Inline prompt configuration for prompt node",
+      "properties": {
+        "TemplateType": {
+          "$ref": "#/definitions/PromptTemplateType"
+        },
+        "TemplateConfiguration": {
+          "$ref": "#/definitions/PromptTemplateConfiguration"
+        },
+        "ModelId": {
+          "type": "string",
+          "maxLength": 2048,
+          "minLength": 1,
+          "pattern": "^(arn:aws(-[^:]+)?:bedrock:[a-z0-9-]{1,20}:(([0-9]{12}:custom-model/[a-z0-9-]{1,63}[.]{1}[a-z0-9-]{1,63}/[a-z0-9]{12})|(:foundation-model/[a-z0-9-]{1,63}[.]{1}[a-z0-9-]{1,63}([.:]?[a-z0-9-]{1,63}))|([0-9]{12}:provisioned-model/[a-z0-9]{12})))|([a-z0-9-]{1,63}[.]{1}[a-z0-9-]{1,63}([.:]?[a-z0-9-]{1,63}))|(([0-9a-zA-Z][_-]?)+)$",
+          "description": "ARN or name of a Bedrock model."
+        },
+        "InferenceConfiguration": {
+          "$ref": "#/definitions/PromptInferenceConfiguration"
+        }
+      },
+      "required": [
+        "ModelId",
+        "TemplateConfiguration",
+        "TemplateType"
+      ],
+      "additionalProperties": false
+    },
+    "PromptFlowNodeResourceConfiguration": {
+      "type": "object",
+      "description": "Resource prompt configuration for prompt node",
+      "properties": {
+        "PromptArn": {
+          "type": "string",
+          "pattern": "^(arn:aws(-[^:]+)?:bedrock:[a-z0-9-]{1,20}:[0-9]{12}:prompt/[0-9a-zA-Z]{10}(?::[0-9]{1,5})?)$",
+          "description": "ARN of a prompt resource possibly with a version"
+        }
+      },
+      "required": [
+        "PromptArn"
+      ],
+      "additionalProperties": false
+    },
+    "PromptFlowNodeSourceConfiguration": {
+      "description": "Prompt source configuration for prompt node",
+      "oneOf": [
+        {
+          "type": "object",
+          "title": "Resource",
+          "properties": {
+            "Resource": {
+              "$ref": "#/definitions/PromptFlowNodeResourceConfiguration"
+            }
+          },
+          "required": [
+            "Resource"
+          ],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "title": "Inline",
+          "properties": {
+            "Inline": {
+              "$ref": "#/definitions/PromptFlowNodeInlineConfiguration"
+            }
+          },
+          "required": [
+            "Inline"
+          ],
+          "additionalProperties": false
+        }
+      ]
+    },
+    "PromptInferenceConfiguration": {
+      "description": "Model inference configuration",
+      "oneOf": [
+        {
+          "type": "object",
+          "title": "Text",
+          "properties": {
+            "Text": {
+              "$ref": "#/definitions/PromptModelInferenceConfiguration"
+            }
+          },
+          "required": [
+            "Text"
+          ],
+          "additionalProperties": false
+        }
+      ]
+    },
+    "PromptInputVariable": {
+      "type": "object",
+      "description": "Input variable",
+      "properties": {
+        "Name": {
+          "type": "string",
+          "pattern": "^([0-9a-zA-Z][_-]?){1,100}$",
+          "description": "Name for an input variable"
+        }
+      },
+      "additionalProperties": false
+    },
+    "PromptModelInferenceConfiguration": {
+      "type": "object",
+      "description": "Prompt model inference configuration",
+      "properties": {
+        "Temperature": {
+          "type": "number",
+          "maximum": 1,
+          "minimum": 0,
+          "description": "Controls randomness, higher values increase diversity"
+        },
+        "TopP": {
+          "type": "number",
+          "maximum": 1,
+          "minimum": 0,
+          "description": "Cumulative probability cutoff for token selection"
+        },
+        "TopK": {
+          "type": "number",
+          "maximum": 500,
+          "minimum": 0,
+          "description": "Sample from the k most likely next tokens"
+        },
+        "MaxTokens": {
+          "type": "number",
+          "maximum": 4096,
+          "minimum": 0,
+          "description": "Maximum length of output"
+        },
+        "StopSequences": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "maxItems": 4,
+          "minItems": 0,
+          "description": "List of stop sequences",
+          "insertionOrder": true
+        }
+      },
+      "additionalProperties": false
+    },
+    "PromptTemplateConfiguration": {
+      "description": "Prompt template configuration",
+      "oneOf": [
+        {
+          "type": "object",
+          "title": "Text",
+          "properties": {
+            "Text": {
+              "$ref": "#/definitions/TextPromptTemplateConfiguration"
+            }
+          },
+          "required": [
+            "Text"
+          ],
+          "additionalProperties": false
+        }
+      ]
+    },
+    "PromptTemplateType": {
+      "type": "string",
+      "description": "Prompt template type",
+      "enum": [
+        "TEXT"
+      ]
+    },
+    "S3Location": {
+      "type": "object",
+      "description": "A bucket, key and optional version pointing to an S3 object containing a UTF-8 encoded JSON string Definition with the same schema as the Definition property of this resource",
+      "properties": {
+        "Bucket": {
+          "type": "string",
+          "maxLength": 63,
+          "minLength": 3,
+          "pattern": "^[a-z0-9][\\.\\-a-z0-9]{1,61}[a-z0-9]$",
+          "description": "A bucket in S3"
+        },
+        "Key": {
+          "type": "string",
+          "maxLength": 1024,
+          "minLength": 1,
+          "description": "A object key in S3"
+        },
+        "Version": {
+          "type": "string",
+          "maxLength": 1024,
+          "minLength": 1,
+          "description": "The version of the the S3 object to use"
+        }
+      },
+      "required": [
+        "Bucket",
+        "Key"
+      ],
+      "additionalProperties": false
+    },
+    "DefinitionSubstitutions": {
+      "type": "object",
+      "description": "When supplied with DefinitionString or DefinitionS3Location, substrings in the definition matching ${keyname} will be replaced with the associated value from this map",
+      "additionalProperties": false,
+      "patternProperties": {
+        "^[a-zA-Z0-9]+$": {
+          "anyOf": [
+            {
+              "type": "string"
+            },
+            {
+              "type": "integer"
+            },
+            {
+              "type": "boolean"
+            }
+          ]
+        }
+      },
+      "minProperties": 1,
+      "maxProperties": 500
+    },
+    "TextPromptTemplateConfiguration": {
+      "type": "object",
+      "description": "Configuration for text prompt template",
+      "properties": {
+        "Text": {
+          "type": "string",
+          "maxLength": 200000,
+          "minLength": 1,
+          "description": "Prompt content for String prompt template"
+        },
+        "InputVariables": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/PromptInputVariable"
+          },
+          "maxItems": 5,
+          "minItems": 0,
+          "description": "List of input variables",
+          "insertionOrder": true
+        }
+      },
+      "required": [
+        "Text"
+      ],
+      "additionalProperties": false
+    },
+    "TagsMap": {
+      "type": "object",
+      "description": "A map of tag keys and values",
+      "patternProperties": {
+        "^[a-zA-Z0-9\\s._:/=+@-]*$": {
+          "type": "string",
+          "maxLength": 256,
+          "minLength": 0,
+          "pattern": "^[a-zA-Z0-9\\s._:/=+@-]*$",
+          "description": "Value of a tag"
+        }
+      },
+      "additionalProperties": false
+    }
+  },
+  "properties": {
+    "Arn": {
+      "type": "string",
+      "maxLength": 1011,
+      "minLength": 20,
+      "pattern": "^arn:aws(-[^:]+)?:bedrock:[a-z0-9-]{1,20}:[0-9]{12}:flow/[0-9a-zA-Z]{10}$",
+      "description": "Arn representation of the Flow"
+    },
+    "CreatedAt": {
+      "type": "string",
+      "description": "Time Stamp.",
+      "format": "date-time"
+    },
+    "Definition": {
+      "$ref": "#/definitions/FlowDefinition"
+    },
+    "DefinitionString": {
+      "type": "string",
+      "description": "A JSON string containing a Definition with the same schema as the Definition property of this resource",
+      "maxLength": 512000
+    },
+    "DefinitionS3Location": {
+      "$ref": "#/definitions/S3Location"
+    },
+    "DefinitionSubstitutions": {
+      "$ref": "#/definitions/DefinitionSubstitutions"
+    },
+    "Description": {
+      "type": "string",
+      "maxLength": 200,
+      "minLength": 1,
+      "description": "Description of the flow"
+    },
+    "ExecutionRoleArn": {
+      "type": "string",
+      "maxLength": 2048,
+      "pattern": "^arn:aws(-[^:]+)?:iam::([0-9]{12})?:role/(service-role/)?.+$",
+      "description": "ARN of a IAM role"
+    },
+    "Id": {
+      "type": "string",
+      "pattern": "^[0-9a-zA-Z]{10}$",
+      "description": "Identifier for a Flow"
+    },
+    "Name": {
+      "type": "string",
+      "pattern": "^([0-9a-zA-Z][_-]?){1,100}$",
+      "description": "Name for the flow"
+    },
+    "Status": {
+      "$ref": "#/definitions/FlowStatus"
+    },
+    "UpdatedAt": {
+      "type": "string",
+      "description": "Time Stamp.",
+      "format": "date-time"
+    },
+    "CustomerEncryptionKeyArn": {
+      "type": "string",
+      "maxLength": 2048,
+      "minLength": 1,
+      "pattern": "^arn:aws(|-cn|-us-gov):kms:[a-zA-Z0-9-]*:[0-9]{12}:key/[a-zA-Z0-9-]{36}$",
+      "description": "A KMS key ARN"
+    },
+    "Version": {
+      "type": "string",
+      "maxLength": 5,
+      "minLength": 5,
+      "pattern": "^DRAFT$",
+      "description": "Draft Version."
+    },
+    "Tags": {
+      "$ref": "#/definitions/TagsMap"
+    },
+    "TestAliasTags": {
+      "$ref": "#/definitions/TagsMap"
+    }
+  },
+  "required": [
+    "ExecutionRoleArn",
+    "Name"
+  ],
+  "readOnlyProperties": [
+    "/properties/Arn",
+    "/properties/CreatedAt",
+    "/properties/Id",
+    "/properties/Status",
+    "/properties/UpdatedAt",
+    "/properties/Version"
+  ],
+  "writeOnlyProperties": [
+    "/properties/DefinitionString",
+    "/properties/DefinitionS3Location",
+    "/properties/DefinitionSubstitutions"
+  ],
+  "primaryIdentifier": [
+    "/properties/Arn"
+  ],
+  "additionalIdentifiers": [
+    [
+      "/properties/Id"
+    ]
+  ],
+  "handlers": {
+    "create": {
+      "permissions": [
+        "bedrock:CreateFlow",
+        "bedrock:GetFlow",
+        "bedrock:PrepareFlow",
+        "iam:PassRole",
+        "s3:GetObject",
+        "s3:GetObjectVersion",
+        "bedrock:TagResource",
+        "bedrock:ListTagsForResource",
+        "kms:GenerateDataKey",
+        "kms:Decrypt"
+      ]
+    },
+    "read": {
+      "permissions": [
+        "bedrock:GetFlow",
+        "bedrock:ListTagsForResource",
+        "kms:Decrypt"
+      ]
+    },
+    "update": {
+      "permissions": [
+        "bedrock:UpdateFlow",
+        "bedrock:GetFlow",
+        "bedrock:PrepareFlow",
+        "iam:PassRole",
+        "s3:GetObject",
+        "s3:GetObjectVersion",
+        "bedrock:TagResource",
+        "bedrock:UntagResource",
+        "bedrock:ListTagsForResource",
+        "kms:GenerateDataKey",
+        "kms:Decrypt"
+      ]
+    },
+    "delete": {
+      "permissions": [
+        "bedrock:DeleteFlow",
+        "bedrock:GetFlow"
+      ]
+    },
+    "list": {
+      "permissions": [
+        "bedrock:ListFlows"
+      ]
+    }
+  },
+  "tagging": {
+    "cloudFormationSystemTags": false,
+    "tagOnCreate": true,
+    "tagProperty": "/properties/Tags",
+    "tagUpdatable": true,
+    "taggable": true,
+    "permissions": [
+      "bedrock:TagResource",
+      "bedrock:UntagResource",
+      "bedrock:ListTagsForResource"
+    ]
+  },
+  "additionalProperties": false
+}
diff --git a/internal/aws/cfn/schemas/aws/bedrock/flowalias.json b/internal/aws/cfn/schemas/aws/bedrock/flowalias.json
new file mode 100644
index 00000000..cc6685ee
--- /dev/null
+++ b/internal/aws/cfn/schemas/aws/bedrock/flowalias.json
@@ -0,0 +1,172 @@
+{
+  "typeName": "AWS::Bedrock::FlowAlias",
+  "description": "Definition of AWS::Bedrock::FlowAlias Resource Type",
+  "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-bedrock-flows",
+  "definitions": {
+    "FlowAliasRoutingConfigurationListItem": {
+      "type": "object",
+      "description": "Details about the routing configuration for a Flow alias.",
+      "properties": {
+        "FlowVersion": {
+          "type": "string",
+          "maxLength": 1,
+          "minLength": 1,
+          "pattern": "^(DRAFT|[0-9]{0,4}[1-9][0-9]{0,4})$",
+          "description": "Version."
+        }
+      },
+      "additionalProperties": false
+    },
+    "TagsMap": {
+      "type": "object",
+      "description": "A map of tag keys and values",
+      "patternProperties": {
+        "^[a-zA-Z0-9\\s._:/=+@-]*$": {
+          "type": "string",
+          "maxLength": 256,
+          "minLength": 0,
+          "pattern": "^[a-zA-Z0-9\\s._:/=+@-]*$",
+          "description": "Value of a tag"
+        }
+      },
+      "additionalProperties": false
+    }
+  },
+  "properties": {
+    "Arn": {
+      "type": "string",
+      "maxLength": 2048,
+      "pattern": "^arn:aws(-[^:]+)?:bedrock:[a-z0-9-]{1,20}:[0-9]{12}:flow/[0-9a-zA-Z]{10}/alias/[0-9a-zA-Z]{10}$",
+      "description": "Arn of the Flow Alias"
+    },
+    "FlowArn": {
+      "type": "string",
+      "maxLength": 2048,
+      "pattern": "^arn:aws(-[^:]+)?:bedrock:[a-z0-9-]{1,20}:[0-9]{12}:flow/[0-9a-zA-Z]{10}$",
+      "description": "Arn representation of the Flow"
+    },
+    "CreatedAt": {
+      "type": "string",
+      "description": "Time Stamp.",
+      "format": "date-time"
+    },
+    "Description": {
+      "type": "string",
+      "maxLength": 200,
+      "minLength": 1,
+      "description": "Description of the Resource."
+    },
+    "FlowId": {
+      "type": "string",
+      "pattern": "^[0-9a-zA-Z]{10}$",
+      "description": "Identifier for a flow resource."
+    },
+    "Id": {
+      "type": "string",
+      "maxLength": 10,
+      "minLength": 10,
+      "pattern": "^(\\bTSTALIASID\\b|[0-9a-zA-Z]+)$",
+      "description": "Id for a Flow Alias generated at the server side."
+    },
+    "Name": {
+      "type": "string",
+      "pattern": "^([0-9a-zA-Z][_-]?){1,100}$",
+      "description": "Name for a resource."
+    },
+    "RoutingConfiguration": {
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/FlowAliasRoutingConfigurationListItem"
+      },
+      "maxItems": 1,
+      "minItems": 1,
+      "description": "Routing configuration for a Flow alias.",
+      "insertionOrder": true
+    },
+    "UpdatedAt": {
+      "type": "string",
+      "description": "Time Stamp.",
+      "format": "date-time"
+    },
+    "Tags": {
+      "$ref": "#/definitions/TagsMap"
+    }
+  },
+  "required": [
+    "Name",
+    "FlowArn",
+    "RoutingConfiguration"
+  ],
+  "readOnlyProperties": [
+    "/properties/Arn",
+    "/properties/CreatedAt",
+    "/properties/FlowId",
+    "/properties/Id",
+    "/properties/UpdatedAt"
+  ],
+  "createOnlyProperties": [
+    "/properties/FlowArn"
+  ],
+  "primaryIdentifier": [
+    "/properties/Arn",
+    "/properties/FlowArn"
+  ],
+  "handlers": {
+    "create": {
+      "permissions": [
+        "bedrock:CreateFlowAlias",
+        "bedrock:GetFlowAlias",
+        "bedrock:TagResource",
+        "bedrock:ListTagsForResource"
+      ]
+    },
+    "read": {
+      "permissions": [
+        "bedrock:GetFlowAlias",
+        "bedrock:ListTagsForResource"
+      ]
+    },
+    "update": {
+      "permissions": [
+        "bedrock:UpdateFlowAlias",
+        "bedrock:GetFlowAlias",
+        "bedrock:TagResource",
+        "bedrock:UntagResource",
+        "bedrock:ListTagsForResource"
+      ]
+    },
+    "delete": {
+      "permissions": [
+        "bedrock:DeleteFlowAlias"
+      ]
+    },
+    "list": {
+      "permissions": [
+        "bedrock:ListFlowAliases"
+      ],
+      "handlerSchema": {
+        "properties": {
+          "FlowArn": {
+            "$ref": "resource-schema.json#/properties/FlowArn"
+          }
+        },
+        "required": [
+          "FlowArn"
+        ]
+      }
+    }
+  },
+  "tagging": {
+    "cloudFormationSystemTags": false,
+    "tagOnCreate": true,
+    "tagProperty": "/properties/Tags",
+    "tagUpdatable": true,
+    "taggable": true,
+    "permissions": [
+      "bedrock:TagResource",
+      "bedrock:UntagResource",
+      "bedrock:ListTagsForResource"
+    ]
+  },
+  "additionalProperties": false
+}
diff --git a/internal/aws/cfn/schemas/aws/bedrock/flowversion.json b/internal/aws/cfn/schemas/aws/bedrock/flowversion.json
new file mode 100644
index 00000000..993753c3
--- /dev/null
+++ b/internal/aws/cfn/schemas/aws/bedrock/flowversion.json
@@ -0,0 +1,786 @@
+{
+  "typeName": "AWS::Bedrock::FlowVersion",
+  "description": "Definition of AWS::Bedrock::FlowVersion Resource Type",
+  "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-bedrock-flows",
+  "definitions": {
+    "ConditionFlowNodeConfiguration": {
+      "type": "object",
+      "description": "Condition flow node configuration",
+      "properties": {
+        "Conditions": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/FlowCondition"
+          },
+          "maxItems": 5,
+          "minItems": 1,
+          "description": "List of conditions in a condition node",
+          "insertionOrder": true
+        }
+      },
+      "required": [
+        "Conditions"
+      ],
+      "additionalProperties": false
+    },
+    "FlowCondition": {
+      "type": "object",
+      "description": "Condition branch for a condition node",
+      "properties": {
+        "Name": {
+          "type": "string",
+          "pattern": "^[a-zA-Z]([_]?[0-9a-zA-Z]){1,50}$",
+          "description": "Name of a condition in a flow"
+        },
+        "Expression": {
+          "type": "string",
+          "maxLength": 64,
+          "minLength": 1,
+          "description": "Expression for a condition in a flow"
+        }
+      },
+      "required": [
+        "Name"
+      ],
+      "additionalProperties": false
+    },
+    "FlowConditionalConnectionConfiguration": {
+      "type": "object",
+      "description": "Conditional connection configuration",
+      "properties": {
+        "Condition": {
+          "type": "string",
+          "pattern": "^[a-zA-Z]([_]?[0-9a-zA-Z]){1,50}$",
+          "description": "Name of a condition in a flow"
+        }
+      },
+      "required": [
+        "Condition"
+      ],
+      "additionalProperties": false
+    },
+    "FlowConnection": {
+      "type": "object",
+      "description": "Flow connection",
+      "properties": {
+        "Type": {
+          "$ref": "#/definitions/FlowConnectionType"
+        },
+        "Name": {
+          "type": "string",
+          "pattern": "^[a-zA-Z]([_]?[0-9a-zA-Z]){1,100}$",
+          "description": "Name of a connection in a flow"
+        },
+        "Source": {
+          "type": "string",
+          "pattern": "^[a-zA-Z]([_]?[0-9a-zA-Z]){1,50}$",
+          "description": "Name of a node in a flow"
+        },
+        "Target": {
+          "type": "string",
+          "pattern": "^[a-zA-Z]([_]?[0-9a-zA-Z]){1,50}$",
+          "description": "Name of a node in a flow"
+        },
+        "Configuration": {
+          "$ref": "#/definitions/FlowConnectionConfiguration"
+        }
+      },
+      "required": [
+        "Name",
+        "Source",
+        "Target",
+        "Type"
+      ],
+      "additionalProperties": false
+    },
+    "FlowConnectionConfiguration": {
+      "description": "Connection configuration",
+      "oneOf": [
+        {
+          "type": "object",
+          "title": "Data",
+          "properties": {
+            "Data": {
+              "$ref": "#/definitions/FlowDataConnectionConfiguration"
+            }
+          },
+          "required": [
+            "Data"
+          ],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "title": "Conditional",
+          "properties": {
+            "Conditional": {
+              "$ref": "#/definitions/FlowConditionalConnectionConfiguration"
+            }
+          },
+          "required": [
+            "Conditional"
+          ],
+          "additionalProperties": false
+        }
+      ]
+    },
+    "FlowConnectionType": {
+      "type": "string",
+      "description": "Connection type",
+      "enum": [
+        "Data",
+        "Conditional"
+      ]
+    },
+    "FlowDataConnectionConfiguration": {
+      "type": "object",
+      "description": "Data connection configuration",
+      "properties": {
+        "SourceOutput": {
+          "type": "string",
+          "pattern": "^[a-zA-Z]([_]?[0-9a-zA-Z]){1,50}$",
+          "description": "Name of a node output in a flow"
+        },
+        "TargetInput": {
+          "type": "string",
+          "pattern": "^[a-zA-Z]([_]?[0-9a-zA-Z]){1,50}$",
+          "description": "Name of a node input in a flow"
+        }
+      },
+      "required": [
+        "SourceOutput",
+        "TargetInput"
+      ],
+      "additionalProperties": false
+    },
+    "FlowDefinition": {
+      "type": "object",
+      "description": "Flow definition",
+      "properties": {
+        "Nodes": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/FlowNode"
+          },
+          "maxItems": 20,
+          "description": "List of nodes in a flow",
+          "insertionOrder": true
+        },
+        "Connections": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/FlowConnection"
+          },
+          "maxItems": 20,
+          "description": "List of connections",
+          "insertionOrder": true
+        }
+      },
+      "additionalProperties": false
+    },
+    "FlowNode": {
+      "type": "object",
+      "description": "Internal mixin for flow node",
+      "properties": {
+        "Name": {
+          "type": "string",
+          "pattern": "^[a-zA-Z]([_]?[0-9a-zA-Z]){1,50}$",
+          "description": "Name of a node in a flow"
+        },
+        "Type": {
+          "$ref": "#/definitions/FlowNodeType"
+        },
+        "Configuration": {
+          "$ref": "#/definitions/FlowNodeConfiguration"
+        },
+        "Inputs": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/FlowNodeInput"
+          },
+          "maxItems": 5,
+          "description": "List of node inputs in a flow",
+          "insertionOrder": true
+        },
+        "Outputs": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/FlowNodeOutput"
+          },
+          "maxItems": 5,
+          "description": "List of node outputs in a flow",
+          "insertionOrder": true
+        }
+      },
+      "required": [
+        "Name",
+        "Type"
+      ],
+      "additionalProperties": false
+    },
+    "FlowNodeConfiguration": {
+      "description": "Node configuration in a flow",
+      "oneOf": [
+        {
+          "type": "object",
+          "title": "Input",
+          "properties": {
+            "Input": {
+              "$ref": "#/definitions/InputFlowNodeConfiguration"
+            }
+          },
+          "required": [
+            "Input"
+          ],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "title": "Output",
+          "properties": {
+            "Output": {
+              "$ref": "#/definitions/OutputFlowNodeConfiguration"
+            }
+          },
+          "required": [
+            "Output"
+          ],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "title": "KnowledgeBase",
+          "properties": {
+            "KnowledgeBase": {
+              "$ref": "#/definitions/KnowledgeBaseFlowNodeConfiguration"
+            }
+          },
+          "required": [
+            "KnowledgeBase"
+          ],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "title": "Condition",
+          "properties": {
+            "Condition": {
+              "$ref": "#/definitions/ConditionFlowNodeConfiguration"
+            }
+          },
+          "required": [
+            "Condition"
+          ],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "title": "Lex",
+          "properties": {
+            "Lex": {
+              "$ref": "#/definitions/LexFlowNodeConfiguration"
+            }
+          },
+          "required": [
+            "Lex"
+          ],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "title": "Prompt",
+          "properties": {
+            "Prompt": {
+              "$ref": "#/definitions/PromptFlowNodeConfiguration"
+            }
+          },
+          "required": [
+            "Prompt"
+          ],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "title": "LambdaFunction",
+          "properties": {
+            "LambdaFunction": {
+              "$ref": "#/definitions/LambdaFunctionFlowNodeConfiguration"
+            }
+          },
+          "required": [
+            "LambdaFunction"
+          ],
+          "additionalProperties": false
+        }
+      ]
+    },
+    "LexFlowNodeConfiguration": {
+      "type": "object",
+      "description": "Lex flow node configuration",
+      "properties": {
+        "BotAliasArn": {
+          "type": "string",
+          "maxLength": 78,
+          "pattern": "^arn:aws(|-us-gov):lex:[a-z]{2}(-gov)?-[a-z]+-\\d{1}:\\d{12}:bot-alias/[0-9a-zA-Z]+/[0-9a-zA-Z]+$",
+          "description": "ARN of a Lex bot alias"
+        },
+        "LocaleId": {
+          "type": "string",
+          "maxLength": 10,
+          "minLength": 1,
+          "description": "Lex bot locale id"
+        }
+      },
+      "required": [
+        "BotAliasArn",
+        "LocaleId"
+      ],
+      "additionalProperties": false
+    },
+    "FlowNodeIODataType": {
+      "type": "string",
+      "description": "Type of input/output for a node in a flow",
+      "enum": [
+        "String",
+        "Number",
+        "Boolean",
+        "Object",
+        "Array"
+      ]
+    },
+    "FlowNodeInput": {
+      "type": "object",
+      "description": "Input to a node in a flow",
+      "properties": {
+        "Name": {
+          "type": "string",
+          "pattern": "^[a-zA-Z]([_]?[0-9a-zA-Z]){1,50}$",
+          "description": "Name of a node input in a flow"
+        },
+        "Type": {
+          "$ref": "#/definitions/FlowNodeIODataType"
+        },
+        "Expression": {
+          "type": "string",
+          "maxLength": 64,
+          "minLength": 1,
+          "description": "Expression for a node input in a flow"
+        }
+      },
+      "required": [
+        "Expression",
+        "Name",
+        "Type"
+      ],
+      "additionalProperties": false
+    },
+    "FlowNodeOutput": {
+      "type": "object",
+      "description": "Output of a node in a flow",
+      "properties": {
+        "Name": {
+          "type": "string",
+          "pattern": "^[a-zA-Z]([_]?[0-9a-zA-Z]){1,50}$",
+          "description": "Name of a node output in a flow"
+        },
+        "Type": {
+          "$ref": "#/definitions/FlowNodeIODataType"
+        }
+      },
+      "required": [
+        "Name",
+        "Type"
+      ],
+      "additionalProperties": false
+    },
+    "FlowNodeType": {
+      "type": "string",
+      "description": "Flow node types",
+      "enum": [
+        "Input",
+        "Output",
+        "KnowledgeBase",
+        "Condition",
+        "Lex",
+        "Prompt",
+        "LambdaFunction"
+      ]
+    },
+    "FlowStatus": {
+      "type": "string",
+      "description": "Schema Type for Flow APIs",
+      "enum": [
+        "Failed",
+        "Prepared",
+        "Preparing",
+        "NotPrepared"
+      ]
+    },
+    "InputFlowNodeConfiguration": {
+      "type": "object",
+      "description": "Input flow node configuration",
+      "additionalProperties": false
+    },
+    "KnowledgeBaseFlowNodeConfiguration": {
+      "type": "object",
+      "description": "Knowledge base flow node configuration",
+      "properties": {
+        "KnowledgeBaseId": {
+          "type": "string",
+          "maxLength": 10,
+          "pattern": "^[0-9a-zA-Z]+$",
+          "description": "Identifier of the KnowledgeBase"
+        },
+        "ModelId": {
+          "type": "string",
+          "maxLength": 2048,
+          "minLength": 1,
+          "pattern": "^arn:aws(-[^:]+)?:bedrock:[a-z0-9-]{1,20}:(([0-9]{12}:custom-model/[a-z0-9-]{1,63}[.]{1}[a-z0-9-]{1,63}(([:][a-z0-9-]{1,63}){0,2})?/[a-z0-9]{12})|(:foundation-model/([a-z0-9-]{1,63}[.]{1}[a-z0-9-]{1,63}([.]?[a-z0-9-]{1,63})([:][a-z0-9-]{1,63}){0,2})))|(([a-z0-9-]{1,63}[.]{1}[a-z0-9-]{1,63}([.]?[a-z0-9-]{1,63})([:][a-z0-9-]{1,63}){0,2}))|(([0-9a-zA-Z][_-]?)+)$",
+          "description": "ARN or name of a Bedrock model."
+        }
+      },
+      "required": [
+        "KnowledgeBaseId"
+      ],
+      "additionalProperties": false
+    },
+    "LambdaFunctionFlowNodeConfiguration": {
+      "type": "object",
+      "description": "Lambda function flow node configuration",
+      "properties": {
+        "LambdaArn": {
+          "type": "string",
+          "maxLength": 2048,
+          "pattern": "^arn:(aws[a-zA-Z-]*)?:lambda:[a-z]{2}(-gov)?-[a-z]+-\\d{1}:\\d{12}:function:[a-zA-Z0-9-_\\.]+(:(\\$LATEST|[a-zA-Z0-9-_]+))?$",
+          "description": "ARN of a Lambda."
+        }
+      },
+      "required": [
+        "LambdaArn"
+      ],
+      "additionalProperties": false
+    },
+    "OutputFlowNodeConfiguration": {
+      "type": "object",
+      "description": "Output flow node configuration",
+      "additionalProperties": false
+    },
+    "PromptFlowNodeConfiguration": {
+      "type": "object",
+      "description": "Prompt flow node configuration",
+      "properties": {
+        "SourceConfiguration": {
+          "$ref": "#/definitions/PromptFlowNodeSourceConfiguration"
+        }
+      },
+      "required": [
+        "SourceConfiguration"
+      ],
+      "additionalProperties": false
+    },
+    "PromptFlowNodeInlineConfiguration": {
+      "type": "object",
+      "description": "Inline prompt configuration for prompt node",
+      "properties": {
+        "TemplateType": {
+          "$ref": "#/definitions/PromptTemplateType"
+        },
+        "TemplateConfiguration": {
+          "$ref": "#/definitions/PromptTemplateConfiguration"
+        },
+        "ModelId": {
+          "type": "string",
+          "maxLength": 2048,
+          "minLength": 1,
+          "pattern": "^(arn:aws(-[^:]+)?:bedrock:[a-z0-9-]{1,20}:(([0-9]{12}:custom-model/[a-z0-9-]{1,63}[.]{1}[a-z0-9-]{1,63}/[a-z0-9]{12})|(:foundation-model/[a-z0-9-]{1,63}[.]{1}[a-z0-9-]{1,63}([.:]?[a-z0-9-]{1,63}))|([0-9]{12}:provisioned-model/[a-z0-9]{12})))|([a-z0-9-]{1,63}[.]{1}[a-z0-9-]{1,63}([.:]?[a-z0-9-]{1,63}))|(([0-9a-zA-Z][_-]?)+)$",
+          "description": "ARN or name of a Bedrock model."
+        },
+        "InferenceConfiguration": {
+          "$ref": "#/definitions/PromptInferenceConfiguration"
+        }
+      },
+      "required": [
+        "ModelId",
+        "TemplateConfiguration",
+        "TemplateType"
+      ],
+      "additionalProperties": false
+    },
+    "PromptFlowNodeResourceConfiguration": {
+      "type": "object",
+      "description": "Resource prompt configuration for prompt node",
+      "properties": {
+        "PromptArn": {
+          "type": "string",
+          "pattern": "^(arn:aws(-[^:]+)?:bedrock:[a-z0-9-]{1,20}:[0-9]{12}:prompt/[0-9a-zA-Z]{10}(?::[0-9]{1,5})?)$",
+          "description": "ARN of a prompt resource possibly with a version"
+        }
+      },
+      "required": [
+        "PromptArn"
+      ],
+      "additionalProperties": false
+    },
+    "PromptFlowNodeSourceConfiguration": {
+      "description": "Prompt source configuration for prompt node",
+      "oneOf": [
+        {
+          "type": "object",
+          "title": "Resource",
+          "properties": {
+            "Resource": {
+              "$ref": "#/definitions/PromptFlowNodeResourceConfiguration"
+            }
+          },
+          "required": [
+            "Resource"
+          ],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "title": "Inline",
+          "properties": {
+            "Inline": {
+              "$ref": "#/definitions/PromptFlowNodeInlineConfiguration"
+            }
+          },
+          "required": [
+            "Inline"
+          ],
+          "additionalProperties": false
+        }
+      ]
+    },
+    "PromptInferenceConfiguration": {
+      "description": "Model inference configuration",
+      "oneOf": [
+        {
+          "type": "object",
+          "title": "Text",
+          "properties": {
+            "Text": {
+              "$ref": "#/definitions/PromptModelInferenceConfiguration"
+            }
+          },
+          "required": [
+            "Text"
+          ],
+          "additionalProperties": false
+        }
+      ]
+    },
+    "PromptInputVariable": {
+      "type": "object",
+      "description": "Input variable",
+      "properties": {
+        "Name": {
+          "type": "string",
+          "pattern": "^([0-9a-zA-Z][_-]?){1,100}$",
+          "description": "Name for an input variable"
+        }
+      },
+      "additionalProperties": false
+    },
+    "PromptModelInferenceConfiguration": {
+      "type": "object",
+      "description": "Prompt model inference configuration",
+      "properties": {
+        "Temperature": {
+          "type": "number",
+          "maximum": 1,
+          "minimum": 0,
+          "description": "Controls randomness, higher values increase diversity"
+        },
+        "TopP": {
+          "type": "number",
+          "maximum": 1,
+          "minimum": 0,
+          "description": "Cumulative probability cutoff for token selection"
+        },
+        "TopK": {
+          "type": "number",
+          "maximum": 500,
+          "minimum": 0,
+          "description": "Sample from the k most likely next tokens"
+        },
+        "MaxTokens": {
+          "type": "number",
+          "maximum": 4096,
+          "minimum": 0,
+          "description": "Maximum length of output"
+        },
+        "StopSequences": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "maxItems": 4,
+          "minItems": 0,
+          "description": "List of stop sequences",
+          "insertionOrder": true
+        }
+      },
+      "additionalProperties": false
+    },
+    "PromptTemplateConfiguration": {
+      "description": "Prompt template configuration",
+      "oneOf": [
+        {
+          "type": "object",
+          "title": "Text",
+          "properties": {
+            "Text": {
+              "$ref": "#/definitions/TextPromptTemplateConfiguration"
+            }
+          },
+          "required": [
+            "Text"
+          ],
+          "additionalProperties": false
+        }
+      ]
+    },
+    "PromptTemplateType": {
+      "type": "string",
+      "description": "Prompt template type",
+      "enum": [
+        "TEXT"
+      ]
+    },
+    "TextPromptTemplateConfiguration": {
+      "type": "object",
+      "description": "Configuration for text prompt template",
+      "properties": {
+        "Text": {
+          "type": "string",
+          "maxLength": 200000,
+          "minLength": 1,
+          "description": "Prompt content for String prompt template"
+        },
+        "InputVariables": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/PromptInputVariable"
+          },
+          "maxItems": 5,
+          "minItems": 0,
+          "description": "List of input variables",
+          "insertionOrder": true
+        }
+      },
+      "required": [
+        "Text"
+      ],
+      "additionalProperties": false
+    }
+  },
+  "properties": {
+    "FlowArn": {
+      "type": "string",
+      "pattern": "^arn:aws(-[^:]+)?:bedrock:[a-z0-9-]{1,20}:[0-9]{12}:flow/[0-9a-zA-Z]{10}$",
+      "description": "Arn representation of the Flow"
+    },
+    "CreatedAt": {
+      "type": "string",
+      "description": "Time Stamp.",
+      "format": "date-time"
+    },
+    "Definition": {
+      "$ref": "#/definitions/FlowDefinition"
+    },
+    "Description": {
+      "type": "string",
+      "maxLength": 200,
+      "minLength": 1,
+      "description": "Description of the flow version"
+    },
+    "ExecutionRoleArn": {
+      "type": "string",
+      "maxLength": 2048,
+      "pattern": "^arn:aws(-[^:]+)?:iam::([0-9]{12})?:role/(service-role/)?.+$",
+      "description": "ARN of a IAM role"
+    },
+    "FlowId": {
+      "type": "string",
+      "pattern": "^[0-9a-zA-Z]{10}$",
+      "description": "Identifier for a Flow"
+    },
+    "Name": {
+      "type": "string",
+      "pattern": "^([0-9a-zA-Z][_-]?){1,100}$",
+      "description": "Name for the flow"
+    },
+    "Status": {
+      "$ref": "#/definitions/FlowStatus"
+    },
+    "Version": {
+      "type": "string",
+      "pattern": "^[0-9]{1,5}$",
+      "description": "Numerical Version."
+    }
+  },
+  "required": [
+    "FlowArn"
+  ],
+  "readOnlyProperties": [
+    "/properties/CreatedAt",
+    "/properties/Definition",
+    "/properties/ExecutionRoleArn",
+    "/properties/FlowId",
+    "/properties/Name",
+    "/properties/Status",
+    "/properties/Version"
+  ],
+  "createOnlyProperties": [
+    "/properties/Description",
+    "/properties/FlowArn"
+  ],
+  "primaryIdentifier": [
+    "/properties/FlowArn",
+    "/properties/Version"
+  ],
+  "handlers": {
+    "create": {
+      "permissions": [
+        "bedrock:CreateFlowVersion",
+        "bedrock:GetFlowVersion"
+      ]
+    },
+    "read": {
+      "permissions": [
+        "bedrock:GetFlowVersion"
+      ]
+    },
+    "delete": {
+      "permissions": [
+        "bedrock:DeleteFlowVersion",
+        "bedrock:GetFlowVersion"
+      ]
+    },
+    "list": {
+      "permissions": [
+        "bedrock:ListFlowVersions"
+      ],
+      "handlerSchema": {
+        "properties": {
+          "FlowArn": {
+            "$ref": "resource-schema.json#/properties/FlowArn"
+          }
+        },
+        "required": [
+          "FlowArn"
+        ]
+      }
+    },
+    "update": {
+      "permissions": [
+        "noservice:NoAction"
+      ]
+    }
+  },
+  "tagging": {
+    "taggable": false
+  },
+  "additionalProperties": false
+}
diff --git a/internal/aws/cfn/schemas/aws/bedrock/knowledgebase.json b/internal/aws/cfn/schemas/aws/bedrock/knowledgebase.json
index 497dd8e4..a2e47682 100644
--- a/internal/aws/cfn/schemas/aws/bedrock/knowledgebase.json
+++ b/internal/aws/cfn/schemas/aws/bedrock/knowledgebase.json
@@ -37,7 +37,8 @@
       "enum": [
         "OPENSEARCH_SERVERLESS",
         "PINECONE",
-        "RDS"
+        "RDS",
+        "MONGO_DB_ATLAS"
       ]
     },
     "KnowledgeBaseType": {
@@ -298,6 +299,89 @@
       ],
       "additionalProperties": false
     },
+    "MongoDbAtlasFieldMapping": {
+      "type": "object",
+      "description": "Contains the names of the fields to which to map information about the vector store.",
+      "properties": {
+        "VectorField": {
+          "type": "string",
+          "maxLength": 2048,
+          "pattern": "^.*$",
+          "description": "The name of the field in which Amazon Bedrock stores the vector embeddings for your data sources."
+        },
+        "TextField": {
+          "type": "string",
+          "maxLength": 2048,
+          "pattern": "^.*$",
+          "description": "The name of the field in which Amazon Bedrock stores the raw text from your data. The text is split according to the chunking strategy you choose."
+        },
+        "MetadataField": {
+          "type": "string",
+          "maxLength": 2048,
+          "pattern": "^.*$",
+          "description": "The name of the field in which Amazon Bedrock stores metadata about the vector store."
+        }
+      },
+      "required": [
+        "VectorField",
+        "MetadataField",
+        "TextField"
+      ],
+      "additionalProperties": false
+    },
+    "MongoDbAtlasConfiguration": {
+      "type": "object",
+      "description": "Contains the storage configuration of the knowledge base in MongoDb Atlas Cloud.",
+      "properties": {
+        "Endpoint": {
+          "type": "string",
+          "maxLength": 2048,
+          "pattern": "^[a-zA-Z0-9_-]+\\.[a-zA-Z0-9_-]+\\.mongodb\\.net$",
+          "description": "MongoDB Atlas endpoint."
+        },
+        "CredentialsSecretArn": {
+          "type": "string",
+          "pattern": "^arn:aws(|-cn|-us-gov):secretsmanager:[a-z0-9-]{1,20}:([0-9]{12}|):secret:[a-zA-Z0-9!/_+=.@-]{1,512}$",
+          "description": "The ARN of the secret that you created in AWS Secrets Manager that is linked to your Amazon Mongo database."
+        },
+        "DatabaseName": {
+          "type": "string",
+          "maxLength": 63,
+          "pattern": "^.*$",
+          "description": "Name of the database within MongoDB Atlas."
+        },
+        "CollectionName": {
+          "type": "string",
+          "maxLength": 63,
+          "pattern": "^.*$",
+          "description": "Name of the collection within MongoDB Atlas."
+        },
+        "VectorIndexName": {
+          "type": "string",
+          "maxLength": 2048,
+          "pattern": "^.*$",
+          "description": "Name of a MongoDB Atlas index."
+        },
+        "EndpointServiceName": {
+          "type": "string",
+          "maxLength": 255,
+          "pattern": "^(?:arn:aws(?:-us-gov|-cn|-iso|-iso-[a-z])*:.+:.*:\\d+:.+/.+$|[a-zA-Z0-9*]+[a-zA-Z0-9._-]*)$",
+          "description": "MongoDB Atlas endpoint service name."
+        },
+        "FieldMapping": {
+          "$ref": "#/definitions/MongoDbAtlasFieldMapping"
+        }
+      },
+      "required": [
+        "Endpoint",
+        "CredentialsSecretArn",
+        "DatabaseName",
+        "CollectionName",
+        "VectorIndexName",
+        "FieldMapping"
+      ],
+      "additionalProperties": false
+    },
     "StorageConfiguration": {
       "type": "object",
       "description": "The vector store service in which the knowledge base is stored.",
@@ -313,6 +397,9 @@
         },
         "RdsConfiguration": {
           "$ref": "#/definitions/RdsConfiguration"
+        },
+        "MongoDbAtlasConfiguration": {
+          "$ref": "#/definitions/MongoDbAtlasConfiguration"
         }
       },
       "required": [
@@ -333,6 +420,11 @@
           "required": [
             "RdsConfiguration"
           ]
+        },
+        {
+          "required": [
+            "MongoDbAtlasConfiguration"
+          ]
         }
       ],
       "additionalProperties": false
@@ -351,6 +443,29 @@
       },
       "additionalProperties": false
     },
+    "BedrockEmbeddingModelConfiguration": {
+      "type": "object",
+      "description": "The vector configuration details for the Bedrock embeddings model.",
+      "properties": {
+        "Dimensions": {
+          "type": "integer",
+          "maximum": 4096,
+          "minimum": 0,
+          "description": "The dimensions details for the vector configuration used on the Bedrock embeddings model."
+        }
+      },
+      "additionalProperties": false
+    },
+    "EmbeddingModelConfiguration": {
+      "type": "object",
+      "description": "The embeddings model configuration details for the vector model used in Knowledge Base.",
+      "properties": {
+        "BedrockEmbeddingModelConfiguration": {
+          "$ref": "#/definitions/BedrockEmbeddingModelConfiguration"
+        }
+      },
+      "additionalProperties": false
+    },
     "VectorKnowledgeBaseConfiguration": {
       "type": "object",
       "description": "Contains details about the model used to create vector embeddings for the knowledge base.",
@@ -359,8 +474,11 @@
           "type": "string",
           "maxLength": 2048,
           "minLength": 20,
-          "pattern": "^(arn:aws(-[^:]+)?:bedrock:[a-z0-9-]{1,20}:(([0-9]{12}:custom-model/[a-z0-9-]{1,63}[.]{1}[a-z0-9-]{1,63}/[a-z0-9]{12})|(:foundation-model/[a-z0-9-]{1,63}[.]{1}[a-z0-9-]{1,63}([.:]?[a-z0-9-]{1,63}))|([0-9]{12}:provisioned-model/[a-z0-9]{12})))|([a-z0-9-]{1,63}[.]{1}[a-z0-9-]{1,63}([.:]?[a-z0-9-]{1,63}))|(([0-9a-zA-Z][_-]?)+)$",
+          "pattern": "^(arn:aws(-[^:]+)?:[a-z0-9-]+:[a-z0-9-]{1,20}:[0-9]{0,12}:[a-zA-Z0-9-:/._+]+)$",
           "description": "The ARN of the model used to create vector embeddings for the knowledge base."
+        },
+        "EmbeddingModelConfiguration": {
+          "$ref": "#/definitions/EmbeddingModelConfiguration"
         }
       },
       "required": [
diff --git a/internal/aws/cfn/schemas/aws/bedrock/prompt.json b/internal/aws/cfn/schemas/aws/bedrock/prompt.json
new file mode 100644
index 00000000..45ccde60
--- /dev/null
+++ b/internal/aws/cfn/schemas/aws/bedrock/prompt.json
@@ -0,0 +1,346 @@
+{
+  "typeName": "AWS::Bedrock::Prompt",
+  "description": "Definition of AWS::Bedrock::Prompt Resource Type",
+  "definitions": {
+    "PromptTemplateType": {
+      "type": "string",
+      "description": "Prompt template type",
+      "enum": [
+        "TEXT"
+      ]
+    },
+    "PromptVariant": {
+      "type": "object",
+      "description": "Prompt variant",
+      "properties": {
+        "Name": {
+          "type": "string",
+          "pattern": "^([0-9a-zA-Z][_-]?){1,100}$",
+          "description": "Name for a variant."
+        },
+        "TemplateType": {
+          "$ref": "#/definitions/PromptTemplateType"
+        },
+        "TemplateConfiguration": {
+          "$ref": "#/definitions/PromptTemplateConfiguration"
+        },
+        "ModelId": {
+          "type": "string",
+          "maxLength": 2048,
+          "minLength": 1,
+          "pattern": "^(arn:aws(-[^:]+)?:bedrock:[a-z0-9-]{1,20}:(([0-9]{12}:custom-model/[a-z0-9-]{1,63}[.]{1}[a-z0-9-]{1,63}/[a-z0-9]{12})|(:foundation-model/[a-z0-9-]{1,63}[.]{1}[a-z0-9-]{1,63}([.:]?[a-z0-9-]{1,63}))|([0-9]{12}:provisioned-model/[a-z0-9]{12})))|([a-z0-9-]{1,63}[.]{1}[a-z0-9-]{1,63}([.:]?[a-z0-9-]{1,63}))|(([0-9a-zA-Z][_-]?)+)$",
+          "description": "ARN or name of a Bedrock model."
+        },
+        "InferenceConfiguration": {
+          "$ref": "#/definitions/PromptInferenceConfiguration"
+        }
+      },
+      "required": [
+        "Name",
+        "TemplateType"
+      ],
+      "additionalProperties": false
+    },
+    "TextPromptTemplateConfiguration": {
+      "type": "object",
+      "description": "Configuration for text prompt template",
+      "properties": {
+        "Text": {
+          "type": "string",
+          "maxLength": 200000,
+          "minLength": 1,
+          "description": "Prompt content for String prompt template"
+        },
+        "TextS3Location": {
+          "$ref": "#/definitions/TextS3Location"
+        },
+        "InputVariables": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/PromptInputVariable"
+          },
+          "maxItems": 5,
+          "minItems": 0,
+          "description": "List of input variables",
+          "insertionOrder": true
+        }
+      },
+      "required": [],
+      "additionalProperties": false
+    },
+    "PromptTemplateConfiguration": {
+      "description": "Prompt template configuration",
+      "oneOf": [
+        {
+          "type": "object",
+          "title": "Text",
+          "properties": {
+            "Text": {
+              "$ref": "#/definitions/TextPromptTemplateConfiguration"
+            }
+          },
+          "required": [
+            "Text"
+          ],
+          "additionalProperties": false
+        }
+      ]
+    },
+    "TextS3Location": {
+      "type": "object",
+      "description": "The identifier for the S3 resource.",
+      "properties": {
+        "Bucket": {
+          "type": "string",
+          "maxLength": 63,
+          "minLength": 3,
+          "pattern": "^[a-z0-9][\\.\\-a-z0-9]{1,61}[a-z0-9]$",
+          "description": "A bucket in S3"
+        },
+        "Key": {
+          "type": "string",
+          "maxLength": 1024,
+          "minLength": 1,
+          "description": "A object key in S3"
+        },
+        "Version": {
+          "type": "string",
+          "maxLength": 1024,
+          "minLength": 1,
+          "description": "The version of the the S3 object to use"
+        }
+      },
+      "required": [
+        "Bucket",
+        "Key"
+      ],
+      "additionalProperties": false
+    },
+    "PromptModelInferenceConfiguration": {
+      "type": "object",
+      "description": "Prompt model inference configuration",
+      "properties": {
+        "Temperature": {
+          "type": "number",
+          "maximum": 1,
+          "minimum": 0,
+          "description": "Controls randomness, higher values increase diversity"
+        },
+        "TopP": {
+          "type": "number",
+          "maximum": 1,
+          "minimum": 0,
+          "description": "Cumulative probability cutoff for token selection"
+        },
+        "TopK": {
+          "type": "number",
+          "maximum": 500,
+          "minimum": 0,
+          "description": "Sample from the k most likely next tokens"
+        },
+        "MaxTokens": {
+          "type": "number",
+          "maximum": 4096,
+          "minimum": 0,
+          "description": "Maximum length of output"
+        },
+        "StopSequences": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "maxItems": 4,
+          "minItems": 0,
+          "description": "List of stop sequences",
+          "insertionOrder": true
+        }
+      },
+      "additionalProperties": false
+    },
+    "PromptInferenceConfiguration": {
+      "description": "Model inference configuration",
+      "oneOf": [
+        {
+          "type": "object",
+          "title": "Text",
+          "properties": {
+            "Text": {
+              "$ref": "#/definitions/PromptModelInferenceConfiguration"
+            }
+          },
+          "required": [
+            "Text"
+          ],
+          "additionalProperties": false
+        }
+      ]
+    },
+    "PromptInputVariable": {
+      "type": "object",
+      "description": "Input variable",
+      "properties": {
+        "Name": {
+          "type": "string",
+          "pattern": "^([0-9a-zA-Z][_-]?){1,100}$",
+          "description": "Name for an input variable"
+        }
+      },
+      "additionalProperties": false
+    },
+    "TagsMap": {
+      "type": "object",
+      "description": "A map of tag keys and values",
+      "patternProperties": {
+        "^[a-zA-Z0-9\\s._:/=+@-]*$": {
+          "type": "string",
+          "maxLength": 256,
+          "minLength": 0,
+          "pattern": "^[a-zA-Z0-9\\s._:/=+@-]*$",
+          "description": "Value of a tag"
+        }
+      },
+      "additionalProperties": false
+    }
+  },
+  "properties": {
+    "Arn": {
+      "type": "string",
+      "maxLength": 2048,
+      "minLength": 1,
+      "pattern": "^(arn:aws(-[^:]+)?:bedrock:[a-z0-9-]{1,20}:[0-9]{12}:prompt/[0-9a-zA-Z]{10})$",
+      "description": "ARN of a prompt resource possibly with a version"
+    },
+    "CreatedAt": {
+      "type": "string",
+      "description": "Time Stamp.",
+      "format": "date-time"
+    },
+    "DefaultVariant": {
+      "type": "string",
+      "pattern": "^([0-9a-zA-Z][_-]?){1,100}$",
+      "description": "Name for a variant."
+    },
+    "Description": {
+      "type": "string",
+      "maxLength": 200,
+      "minLength": 1,
+      "description": "Name for a prompt resource."
+    },
+    "Id": {
+      "type": "string",
+      "pattern": "^[0-9a-zA-Z]{10}$",
+      "description": "Identifier for a Prompt"
+    },
+    "Name": {
+      "type": "string",
+      "pattern": "^([0-9a-zA-Z][_-]?){1,100}$",
+      "description": "Name for a prompt resource."
+    },
+    "UpdatedAt": {
+      "type": "string",
+      "description": "Time Stamp.",
+      "format": "date-time"
+    },
+    "Variants": {
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/PromptVariant"
+      },
+      "maxItems": 3,
+      "minItems": 0,
+      "description": "List of prompt variants",
+      "insertionOrder": true
+    },
+    "Tags": {
+      "$ref": "#/definitions/TagsMap"
+    },
+    "CustomerEncryptionKeyArn": {
+      "type": "string",
+      "maxLength": 2048,
+      "minLength": 1,
+      "pattern": "^arn:aws(|-cn|-us-gov):kms:[a-zA-Z0-9-]*:[0-9]{12}:key/[a-zA-Z0-9-]{36}$",
+      "description": "A KMS key ARN"
+    },
+    "Version": {
+      "type": "string",
+      "maxLength": 5,
+      "minLength": 5,
+      "pattern": "^DRAFT$",
+      "description": "Draft Version."
+    }
+  },
+  "required": [
+    "Name"
+  ],
+  "readOnlyProperties": [
+    "/properties/Arn",
+    "/properties/CreatedAt",
+    "/properties/Id",
+    "/properties/UpdatedAt",
+    "/properties/Version"
+  ],
+  "writeOnlyProperties": [
+    "/properties/Variants/*/TemplateConfiguration/Text/TextS3Location"
+  ],
+  "primaryIdentifier": [
+    "/properties/Arn"
+  ],
+  "handlers": {
+    "create": {
+      "permissions": [
+        "bedrock:CreatePrompt",
+        "bedrock:GetPrompt",
+        "s3:GetObject",
+        "s3:GetObjectVersion",
+        "bedrock:TagResource",
+        "bedrock:ListTagsForResource",
+        "kms:GenerateDataKey",
+        "kms:Decrypt"
+      ]
+    },
+    "read": {
+      "permissions": [
+        "bedrock:GetPrompt",
+        "bedrock:ListTagsForResource",
+        "kms:Decrypt"
+      ]
+    },
+    "update": {
+      "permissions": [
+        "bedrock:UpdatePrompt",
+        "bedrock:GetPrompt",
+        "s3:GetObject",
+        "s3:GetObjectVersion",
+        "bedrock:TagResource",
+        "bedrock:UntagResource",
+        "bedrock:ListTagsForResource",
+        "kms:GenerateDataKey",
+        "kms:Decrypt"
+      ]
+    },
+    "delete": {
+      "permissions": [
+        "bedrock:DeletePrompt",
+        "bedrock:GetPrompt"
+      ]
+    },
+    "list": {
+      "permissions": [
+        "bedrock:ListPrompts"
+      ]
+    }
+  },
+  "tagging": {
+    "cloudFormationSystemTags": false,
+    "tagOnCreate": true,
+    "tagProperty": "/properties/Tags",
+    "tagUpdatable": true,
+    "taggable": true,
+    "permissions": [
+      "bedrock:TagResource",
+      "bedrock:UntagResource",
+      "bedrock:ListTagsForResource"
+    ]
+  },
+  "additionalProperties": false
+}
diff --git a/internal/aws/cfn/schemas/aws/bedrock/promptversion.json b/internal/aws/cfn/schemas/aws/bedrock/promptversion.json
new file mode 100644
index 00000000..b2f2c7b3
--- /dev/null
+++ b/internal/aws/cfn/schemas/aws/bedrock/promptversion.json
@@ -0,0 +1,288 @@
+{
+  "typeName": "AWS::Bedrock::PromptVersion",
+  "description": "Definition of AWS::Bedrock::PromptVersion Resource Type",
+  "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-bedrock-prompts",
+  "definitions": {
+    "PromptTemplateType": {
+      "type": "string",
+      "description": "Prompt template type",
+      "enum": [
+        "TEXT"
+      ]
+    },
+    "PromptVariant": {
+      "type": "object",
+      "description": "Prompt variant",
+      "properties": {
+        "Name": {
+          "type": "string",
+          "pattern": "^([0-9a-zA-Z][_-]?){1,100}$",
+          "description": "Name for a variant."
+        },
+        "TemplateType": {
+          "$ref": "#/definitions/PromptTemplateType"
+        },
+        "TemplateConfiguration": {
+          "$ref": "#/definitions/PromptTemplateConfiguration"
+        },
+        "ModelId": {
+          "type": "string",
+          "maxLength": 2048,
+          "minLength": 1,
+          "pattern": "^(arn:aws(-[^:]+)?:bedrock:[a-z0-9-]{1,20}:(([0-9]{12}:custom-model/[a-z0-9-]{1,63}[.]{1}[a-z0-9-]{1,63}/[a-z0-9]{12})|(:foundation-model/[a-z0-9-]{1,63}[.]{1}[a-z0-9-]{1,63}([.:]?[a-z0-9-]{1,63}))|([0-9]{12}:provisioned-model/[a-z0-9]{12})))|([a-z0-9-]{1,63}[.]{1}[a-z0-9-]{1,63}([.:]?[a-z0-9-]{1,63}))|(([0-9a-zA-Z][_-]?)+)$",
+          "description": "ARN or name of a Bedrock model."
+        },
+        "InferenceConfiguration": {
+          "$ref": "#/definitions/PromptInferenceConfiguration"
+        }
+      },
+      "required": [
+        "Name",
+        "TemplateType"
+      ],
+      "additionalProperties": false
+    },
+    "TextPromptTemplateConfiguration": {
+      "type": "object",
+      "description": "Configuration for text prompt template",
+      "properties": {
+        "Text": {
+          "type": "string",
+          "maxLength": 200000,
+          "minLength": 1,
+          "description": "Prompt content for String prompt template"
+        },
+        "InputVariables": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/PromptInputVariable"
+          },
+          "maxItems": 5,
+          "minItems": 1,
+          "description": "List of input variables",
+          "insertionOrder": true
+        }
+      },
+      "required": [
+        "Text"
+      ],
+      "additionalProperties": false
+    },
+    "PromptTemplateConfiguration": {
+      "description": "Prompt template configuration",
+      "oneOf": [
+        {
+          "type": "object",
+          "title": "Text",
+          "properties": {
+            "Text": {
+              "$ref": "#/definitions/TextPromptTemplateConfiguration"
+            }
+          },
+          "required": [
+            "Text"
+          ],
+          "additionalProperties": false
+        }
+      ]
+    },
+    "PromptModelInferenceConfiguration": {
+      "type": "object",
+      "description": "Prompt model inference configuration",
+      "properties": {
+        "Temperature": {
+          "type": "number",
+          "maximum": 1,
+          "minimum": 0,
+          "description": "Controls randomness, higher values increase diversity"
+        },
+        "TopP": {
+          "type": "number",
+          "maximum": 1,
+          "minimum": 0,
+          "description": "Cumulative probability cutoff for token selection"
+        },
+        "TopK": {
+          "type": "number",
+          "maximum": 500,
+          "minimum": 0,
+          "description": "Sample from the k most likely next tokens"
+        },
+        "MaxTokens": {
+          "type": "number",
+          "maximum": 4096,
+          "minimum": 0,
+          "description": "Maximum length of output"
+        },
+        "StopSequences": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "maxItems": 4,
+          "minItems": 0,
+          "description": "List of stop sequences",
+          "insertionOrder": true
+        }
+      },
+      "additionalProperties": false
+    },
+    "PromptInferenceConfiguration": {
+      "description": "Model inference configuration",
+      "oneOf": [
+        {
+          "type": "object",
+          "title": "Text",
+          "properties": {
+            "Text": {
+              "$ref": "#/definitions/PromptModelInferenceConfiguration"
+            }
+          },
+          "required": [
+            "Text"
+          ],
+          "additionalProperties": false
+        }
+      ]
+    },
+    "PromptInputVariable": {
+      "type": "object",
+      "description": "Input variable",
+      "properties": {
+        "Name": {
+          "type": "string",
+          "pattern": "^([0-9a-zA-Z][_-]?){1,100}$",
+          "description": "Name for an input variable"
+        }
+      },
+      "additionalProperties": false
+    }
+  },
+  "properties": {
+    "PromptArn": {
+      "type": "string",
+      "maxLength": 2048,
+      "minLength": 1,
+      "pattern": "^(arn:aws(-[^:]+)?:bedrock:[a-z0-9-]{1,20}:[0-9]{12}:prompt/[0-9a-zA-Z]{10})$",
+      "description": "ARN of a prompt resource possibly with a version"
+    },
+    "Arn": {
+      "type": "string",
+      "maxLength": 2048,
+      "minLength": 1,
+      "pattern": "^(arn:aws(-[^:]+)?:bedrock:[a-z0-9-]{1,20}:[0-9]{12}:prompt/[0-9a-zA-Z]{10}:[0-9]{1,20})$",
+      "description": "ARN of a prompt version resource"
+    },
+    "CreatedAt": {
+      "type": "string",
+      "description": "Time Stamp.",
+      "format": "date-time"
+    },
+    "PromptId": {
+      "type": "string",
+      "pattern": "^[0-9a-zA-Z]{10}$",
+      "description": "Identifier for a Prompt"
+    },
+    "UpdatedAt": {
+      "type": "string",
+      "description": "Time Stamp.",
+      "format": "date-time"
+    },
+    "Version": {
+      "type": "string",
+      "maxLength": 5,
+      "minLength": 1,
+      "pattern": "^(DRAFT|[0-9]{0,4}[1-9][0-9]{0,4})$",
+      "description": "Version."
+    },
+    "Variants": {
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/PromptVariant"
+      },
+      "maxItems": 3,
+      "minItems": 1,
+      "description": "List of prompt variants",
+      "insertionOrder": true
+    },
+    "DefaultVariant": {
+      "type": "string",
+      "pattern": "^([0-9a-zA-Z][_-]?){1,100}$",
+      "description": "Name for a variant."
+    },
+    "Description": {
+      "type": "string",
+      "maxLength": 200,
+      "minLength": 1,
+      "description": "Description for a prompt version resource."
+    },
+    "Name": {
+      "type": "string",
+      "pattern": "^([0-9a-zA-Z][_-]?){1,100}$",
+      "description": "Name for a prompt resource."
+    }
+  },
+  "required": [
+    "PromptArn"
+  ],
+  "readOnlyProperties": [
+    "/properties/Arn",
+    "/properties/CreatedAt",
+    "/properties/PromptId",
+    "/properties/UpdatedAt",
+    "/properties/Version",
+    "/properties/Name",
+    "/properties/DefaultVariant",
+    "/properties/Variants"
+  ],
+  "primaryIdentifier": [
+    "/properties/Arn"
+  ],
+  "createOnlyProperties": [
+    "/properties/PromptArn",
+    "/properties/Description"
+  ],
+  "handlers": {
+    "create": {
+      "permissions": [
+        "bedrock:CreatePromptVersion",
+        "bedrock:GetPrompt"
+      ]
+    },
+    "read": {
+      "permissions": [
+        "bedrock:GetPrompt"
+      ]
+    },
+    "update": {
+      "permissions": [
+        "noservice:NoAction"
+      ]
+    },
+    "delete": {
+      "permissions": [
+        "bedrock:DeletePrompt",
+        "bedrock:GetPrompt"
+      ]
+    },
+    "list": {
+      "permissions": [
+        "bedrock:ListPrompts"
+      ],
+      "handlerSchema": {
+        "properties": {
+          "PromptArn": {
+            "$ref": "resource-schema.json#/properties/PromptArn"
+          }
+        },
+        "required": [
+          "PromptArn"
+        ]
+      }
+    }
+  },
+  "tagging": {
+    "taggable": false
+  },
+  "additionalProperties": false
+}
diff --git a/internal/aws/cfn/schemas/aws/cleanroomsml/trainingdataset.json b/internal/aws/cfn/schemas/aws/cleanroomsml/trainingdataset.json
index 598c2cac..cc022323 100644
--- a/internal/aws/cfn/schemas/aws/cleanroomsml/trainingdataset.json
+++ b/internal/aws/cfn/schemas/aws/cleanroomsml/trainingdataset.json
@@ -218,7 +218,11 @@
     "tagOnCreate": true,
     "tagUpdatable": true,
     "cloudFormationSystemTags": true,
-    "tagProperty": "/properties/Tags"
+    "tagProperty": "/properties/Tags",
+    "permissions": [
+      "cleanrooms-ml:TagResource",
+      "cleanrooms-ml:UntagResource"
+    ]
   },
   "handlers": {
     "create": {
diff --git a/internal/aws/cfn/schemas/aws/codeartifact/packagegroup.json b/internal/aws/cfn/schemas/aws/codeartifact/packagegroup.json
index 39240eef..ea7eb391 100644
--- a/internal/aws/cfn/schemas/aws/codeartifact/packagegroup.json
+++ b/internal/aws/cfn/schemas/aws/codeartifact/packagegroup.json
@@ -206,6 +206,11 @@
     "tagOnCreate": true,
     "tagUpdatable": true,
     "cloudFormationSystemTags": true,
-    "tagProperty": "/properties/Tags"
+    "tagProperty": "/properties/Tags",
+    "permissions": [
+      "codeartifact:ListTagsForResource",
+      "codeartifact:UntagResource",
+      "codeartifact:TagResource"
+    ]
   }
 }
diff --git a/internal/aws/cfn/schemas/aws/connectcampaigns/campaign.json b/internal/aws/cfn/schemas/aws/connectcampaigns/campaign.json
index 3a482d00..54381dee 100644
--- a/internal/aws/cfn/schemas/aws/connectcampaigns/campaign.json
+++ b/internal/aws/cfn/schemas/aws/connectcampaigns/campaign.json
@@ -209,7 +209,11 @@
     "tagOnCreate": true,
     "tagUpdatable": true,
     "cloudFormationSystemTags": false,
-    "tagProperty": "/properties/Tags"
+    "tagProperty": "/properties/Tags",
+    "permissions": [
+      "connect-campaigns:UntagResource",
+      "connect-campaigns:TagResource"
+    ]
   },
   "required": [
     "ConnectInstanceArn",
diff --git a/internal/aws/cfn/schemas/aws/dms/replicationconfig.json b/internal/aws/cfn/schemas/aws/dms/replicationconfig.json
index 0d28b9a1..f17e1e0f 100644
--- a/internal/aws/cfn/schemas/aws/dms/replicationconfig.json
+++ b/internal/aws/cfn/schemas/aws/dms/replicationconfig.json
@@ -142,9 +142,22 @@
     "tagOnCreate": true,
     "tagUpdatable": true,
     "cloudFormationSystemTags": false,
-    "tagProperty": "/properties/Tags"
+    "tagProperty": "/properties/Tags",
+    "permissions": [
+      "dms:AddTagsToResource",
+      "dms:ListTagsForResource",
+      "dms:RemoveTagsFromResource"
+    ]
   },
   "additionalProperties": false,
+  "required": [
+    "ReplicationConfigIdentifier",
+    "SourceEndpointArn",
+    "TargetEndpointArn",
+    "ReplicationType",
+    "ComputeConfig",
+    "TableMappings"
+  ],
   "handlers": {
     "create": {
       "permissions": [
@@ -167,7 +180,7 @@
       "permissions": [
         "dms:ModifyReplicationConfig",
         "dms:AddTagsToResource",
-        "dms:RemoveTagsToResource",
+        "dms:RemoveTagsFromResource",
         "dms:ListTagsForResource",
         "iam:CreateServiceLinkedRole",
         "iam:AttachRolePolicy",
diff --git a/internal/aws/cfn/schemas/aws/ec2/eipassociation.json b/internal/aws/cfn/schemas/aws/ec2/eipassociation.json
index 2f3d719b..607ec04f 100644
--- a/internal/aws/cfn/schemas/aws/ec2/eipassociation.json
+++ b/internal/aws/cfn/schemas/aws/ec2/eipassociation.json
@@ -1,30 +1,30 @@
 {
   "typeName": "AWS::EC2::EIPAssociation",
-  "description": "Resource schema for EC2 EIP association.",
+  "description": "Associates an Elastic IP address with an instance or a network interface. Before you can use an Elastic IP address, you must allocate it to your account. For more information about working with Elastic IP addresses, see [Elastic IP address concepts and rules](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-eips.html#vpc-eip-overview).\n You must specify ``AllocationId`` and either ``InstanceId``, ``NetworkInterfaceId``, or ``PrivateIpAddress``.",
   "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-ec2/tree/master/aws-ec2-eipassociation",
   "properties": {
     "Id": {
-      "description": "Composite ID of non-empty properties, to determine the identification.",
+      "description": "",
       "type": "string"
     },
     "AllocationId": {
-      "description": "The allocation ID. This is required for EC2-VPC.",
+      "description": "The allocation ID. This is required.",
       "type": "string"
     },
     "NetworkInterfaceId": {
-      "description": "The ID of the network interface.",
+      "description": "The ID of the network interface. If the instance has more than one network interface, you must specify a network interface ID.\n You can specify either the instance ID or the network interface ID, but not both.",
       "type": "string"
     },
     "InstanceId": {
-      "description": "The ID of the instance.",
+      "description": "The ID of the instance. The instance must have exactly one attached network interface. You can specify either the instance ID or the network interface ID, but not both.",
       "type": "string"
     },
     "PrivateIpAddress": {
-      "description": "The primary or secondary private IP address to associate with the Elastic IP address.",
+      "description": "The primary or secondary private IP address to associate with the Elastic IP address. If no private IP address is specified, the Elastic IP address is associated with the primary private IP address.",
       "type": "string"
     },
     "EIP": {
-      "description": "The Elastic IP address to associate with the instance.",
+      "description": "",
       "type": "string"
     }
   },
diff --git a/internal/aws/cfn/schemas/aws/ec2/instance.json b/internal/aws/cfn/schemas/aws/ec2/instance.json
index da37acb4..5d874fa6 100644
--- a/internal/aws/cfn/schemas/aws/ec2/instance.json
+++ b/internal/aws/cfn/schemas/aws/ec2/instance.json
@@ -165,13 +165,14 @@
     }
   },
   "writeOnlyProperties": [
-    "/properties/BlockDeviceMappings/*/BlockDeviceMapping/NoDevice",
-    "/properties/BlockDeviceMappings/*/BlockDeviceMapping/VirtualName",
+    "/properties/BlockDeviceMappings/*/NoDevice",
+    "/properties/BlockDeviceMappings/*/VirtualName",
     "/properties/LicenseSpecification",
     "/properties/AdditionalInfo",
     "/properties/Ipv6AddressCount",
     "/properties/Ipv6Addresses",
-    "/properties/PropagateTagsToVolumeOnCreation"
+    "/properties/PropagateTagsToVolumeOnCreation",
+    "/properties/LaunchTemplate"
   ],
   "additionalProperties": false,
   "definitions": {
diff --git a/internal/aws/cfn/schemas/aws/ec2/keypair.json b/internal/aws/cfn/schemas/aws/ec2/keypair.json
index 1f5457c9..499c71fc 100644
--- a/internal/aws/cfn/schemas/aws/ec2/keypair.json
+++ b/internal/aws/cfn/schemas/aws/ec2/keypair.json
@@ -101,7 +101,11 @@
   "tagging": {
     "taggable": true,
     "tagUpdatable": false,
-    "cloudFormationSystemTags": false
+    "cloudFormationSystemTags": false,
+    "tagProperty": "/properties/Tags",
+    "permissions": [
+      "ec2:CreateTags"
+    ]
   },
   "handlers": {
     "create": {
diff --git a/internal/aws/cfn/schemas/aws/ec2/launchtemplate.json b/internal/aws/cfn/schemas/aws/ec2/launchtemplate.json
index 08b81fda..649cb54d 100644
--- a/internal/aws/cfn/schemas/aws/ec2/launchtemplate.json
+++ b/internal/aws/cfn/schemas/aws/ec2/launchtemplate.json
@@ -77,7 +77,7 @@
           }
         },
         "UserData": {
-          "description": "The user data to make available to the instance. You must provide base64-encoded text. User data is limited to 16 KB. For more information, see [Run commands on your Linux instance at launch](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/user-data.html) (Linux) or [Work with instance user data](https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/instancedata-add-user-data.html) (Windows) in the *Amazon Elastic Compute Cloud User Guide*.\n If you are creating the launch template for use with BATCH, the user data must be provided in the [MIME multi-part archive format](https://docs.aws.amazon.com/https://cloudinit.readthedocs.io/en/latest/topics/format.html#mime-multi-part-archive). For more information, see [Amazon EC2 user data in launch templates](https://docs.aws.amazon.com/batch/latest/userguide/launch-templates.html) in the *User Guide*.",
+          "description": "The user data to make available to the instance. You must provide base64-encoded text. User data is limited to 16 KB. For more information, see [Run commands on your Amazon EC2 instance at launch](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/user-data.html) in the *Amazon EC2 User Guide*.\n If you are creating the launch template for use with BATCH, the user data must be provided in the [MIME multi-part archive format](https://docs.aws.amazon.com/https://cloudinit.readthedocs.io/en/latest/topics/format.html#mime-multi-part-archive). For more information, see [Amazon EC2 user data in launch templates](https://docs.aws.amazon.com/batch/latest/userguide/launch-templates.html) in the *User Guide*.",
           "type": "string"
         },
         "BlockDeviceMappings": {
@@ -141,7 +141,7 @@
           "type": "string"
         },
         "InstanceType": {
-          "description": "The instance type. For more information, see [Instance types](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-types.html) in the *Amazon Elastic Compute Cloud User Guide*.\n If you specify ``InstanceType``, you can't specify ``InstanceRequirements``.",
+          "description": "The instance type. For more information, see [Amazon EC2 instance types](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-types.html) in the *Amazon EC2 User Guide*.\n If you specify ``InstanceType``, you can't specify ``InstanceRequirements``.",
           "type": "string"
         },
         "Monitoring": {
@@ -149,11 +149,11 @@
           "$ref": "#/definitions/Monitoring"
         },
         "HibernationOptions": {
-          "description": "Indicates whether an instance is enabled for hibernation. This parameter is valid only if the instance meets the [hibernation prerequisites](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/hibernating-prerequisites.html). For more information, see [Hibernate your instance](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Hibernate.html) in the *Amazon Elastic Compute Cloud User Guide*.",
+          "description": "Indicates whether an instance is enabled for hibernation. This parameter is valid only if the instance meets the [hibernation prerequisites](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/hibernating-prerequisites.html). For more information, see [Hibernate your Amazon EC2 instance](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Hibernate.html) in the *Amazon EC2 User Guide*.",
           "$ref": "#/definitions/HibernationOptions"
         },
         "MetadataOptions": {
-          "description": "The metadata options for the instance. For more information, see [Instance metadata and user data](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html) in the *Amazon Elastic Compute Cloud User Guide*.",
+          "description": "The metadata options for the instance. For more information, see [Instance metadata and user data](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html) in the *Amazon EC2 User Guide*.",
           "$ref": "#/definitions/MetadataOptions"
         },
         "LicenseSpecifications": {
@@ -169,11 +169,11 @@
           "type": "string"
         },
         "DisableApiStop": {
-          "description": "Indicates whether to enable the instance for stop protection. For more information, see [Stop protection](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Stop_Start.html#Using_StopProtection) in the *Amazon Elastic Compute Cloud User Guide*.",
+          "description": "Indicates whether to enable the instance for stop protection. For more information, see [Enable stop protection for your instance](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-stop-protection.html) in the *Amazon EC2 User Guide*.",
           "type": "boolean"
         },
         "CpuOptions": {
-          "description": "The CPU options for the instance. For more information, see [Optimizing CPU Options](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-optimize-cpu.html) in the *Amazon Elastic Compute Cloud User Guide*.",
+          "description": "The CPU options for the instance. For more information, see [Optimize CPU options](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-optimize-cpu.html) in the *Amazon EC2 User Guide*.",
           "$ref": "#/definitions/CpuOptions"
         },
         "PrivateDnsNameOptions": {
@@ -205,7 +205,7 @@
           "$ref": "#/definitions/InstanceRequirements"
         },
         "RamDiskId": {
-          "description": "The ID of the RAM disk.\n  We recommend that you use PV-GRUB instead of kernels and RAM disks. For more information, see [User provided kernels](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/UserProvidedkernels.html) in the *Amazon Elastic Compute Cloud User Guide*.",
+          "description": "The ID of the RAM disk.\n  We recommend that you use PV-GRUB instead of kernels and RAM disks. For more information, see [User provided kernels](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/UserProvidedkernels.html) in the *Amazon EC2 User Guide*.",
           "type": "string"
         },
         "CapacityReservationSpecification": {
@@ -257,7 +257,7 @@
       "type": "object",
       "properties": {
         "Type": {
-          "description": "The type of Elastic Graphics accelerator. For more information about the values to specify for ``Type``, see [Elastic Graphics Basics](https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/elastic-graphics.html#elastic-graphics-basics), specifically the Elastic Graphics accelerator column, in the *Amazon Elastic Compute Cloud User Guide for Windows Instances*.",
+          "description": "The type of Elastic Graphics accelerator.",
           "type": "string"
         }
       }
@@ -313,7 +313,7 @@
       "type": "object",
       "properties": {
         "Ipv4Prefix": {
-          "description": "The IPv4 prefix. For information, see [Assigning prefixes to Amazon EC2 network interfaces](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-prefix-eni.html) in the *Amazon Elastic Compute Cloud User Guide*.",
+          "description": "The IPv4 prefix. For information, see [Assigning prefixes to network interfaces](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-prefix-eni.html) in the *Amazon EC2 User Guide*.",
           "type": "string"
         }
       }
@@ -660,7 +660,7 @@
           "type": "integer"
         },
         "InterfaceType": {
-          "description": "The type of network interface. To create an Elastic Fabric Adapter (EFA), specify ``efa``. For more information, see [Elastic Fabric Adapter](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/efa.html) in the *Amazon Elastic Compute Cloud User Guide*.\n If you are not creating an EFA, specify ``interface`` or omit this parameter.\n Valid values: ``interface`` | ``efa``",
+          "description": "The type of network interface. To create an Elastic Fabric Adapter (EFA), specify ``efa``. For more information, see [Elastic Fabric Adapter](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/efa.html) in the *Amazon EC2 User Guide*.\n If you are not creating an EFA, specify ``interface`` or omit this parameter.\n Valid values: ``interface`` | ``efa``",
           "type": "string"
         },
         "AssociateCarrierIpAddress": {
@@ -744,7 +744,7 @@
       "type": "object",
       "properties": {
         "ResourceType": {
-          "description": "The type of resource. To tag the launch template, ``ResourceType`` must be ``launch-template``.",
+          "description": "The type of resource. To tag a launch template, ``ResourceType`` must be ``launch-template``.",
           "type": "string"
         },
         "Tags": {
@@ -763,7 +763,7 @@
       "type": "object",
       "properties": {
         "ResourceType": {
-          "description": "The type of resource to tag.\n Valid Values lists all resource types for Amazon EC2 that can be tagged. When you create a launch template, you can specify tags for the following resource types only: ``instance`` | ``volume`` | ``network-interface`` | ``spot-instances-request``. If the instance does not include the resource type that you specify, the instance launch fails. For example, not all instance types include a volume.\n To tag a resource after it has been created, see [CreateTags](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateTags.html).",
+          "description": "The type of resource to tag. You can specify tags for the following resource types only: ``instance`` | ``volume`` | ``network-interface`` | ``spot-instances-request``. If the instance does not include the resource type that you specify, the instance launch fails. For example, not all instance types include a volume.\n To tag a resource after it has been created, see [CreateTags](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateTags.html).",
           "type": "string"
         },
         "Tags": {
@@ -957,7 +957,7 @@
           "type": "boolean"
         },
         "MaxSpotPriceAsPercentageOfOptimalOnDemandPrice": {
-          "description": "[Price protection] The price protection threshold for Spot Instances, as a percentage of an identified On-Demand price. The identified On-Demand price is the price of the lowest priced current generation C, M, or R instance type with your specified attributes. If no current generation C, M, or R instance type matches your attributes, then the identified price is from the lowest priced current generation instance types, and failing that, from the lowest priced previous generation instance types that match your attributes. When Amazon EC2 selects instance types with your attributes, it will exclude instance types whose price exceeds your specified threshold.\n The parameter accepts an integer, which Amazon EC2 interprets as a percentage.\n If you set ``DesiredCapacityType`` to ``vcpu`` or ``memory-mib``, the price protection threshold is based on the per vCPU or per memory price instead of the per instance price.\n  Only one of ``SpotMaxPricePercentageOverLowestPrice`` or ``MaxSpotPriceAsPercentageOfOptimalOnDemandPrice`` can be specified. If you don't specify either, Amazon EC2 will automatically apply optimal price protection to consistently select from a wide range of instance types. To indicate no price protection threshold for Spot Instances, meaning you want to consider all instance types that match your attributes, include one of these parameters and specify a high value, such as ``999999``.",
+          "description": "[Price protection] The price protection threshold for Spot Instances, as a percentage of an identified On-Demand price. The identified On-Demand price is the price of the lowest priced current generation C, M, or R instance type with your specified attributes. If no current generation C, M, or R instance type matches your attributes, then the identified price is from the lowest priced current generation instance types, and failing that, from the lowest priced previous generation instance types that match your attributes. When Amazon EC2 selects instance types with your attributes, it will exclude instance types whose price exceeds your specified threshold.\n The parameter accepts an integer, which Amazon EC2 interprets as a percentage.\n If you set ``TargetCapacityUnitType`` to ``vcpu`` or ``memory-mib``, the price protection threshold is based on the per vCPU or per memory price instead of the per instance price.\n  Only one of ``SpotMaxPricePercentageOverLowestPrice`` or ``MaxSpotPriceAsPercentageOfOptimalOnDemandPrice`` can be specified. If you don't specify either, Amazon EC2 will automatically apply optimal price protection to consistently select from a wide range of instance types. To indicate no price protection threshold for Spot Instances, meaning you want to consider all instance types that match your attributes, include one of these parameters and specify a high value, such as ``999999``.",
           "type": "integer"
         },
         "SpotMaxPricePercentageOverLowestPrice": {
@@ -1089,7 +1089,7 @@
       }
     },
     "ConnectionTrackingSpecification": {
-      "description": "A security group connection tracking specification that enables you to set the idle timeout for connection tracking on an Elastic network interface. For more information, see [Connection tracking timeouts](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-connection-tracking.html#connection-tracking-timeouts) in the *Amazon Elastic Compute Cloud User Guide*.",
+      "description": "A security group connection tracking specification that enables you to set the idle timeout for connection tracking on an Elastic network interface. For more information, see [Connection tracking timeouts](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-connection-tracking.html#connection-tracking-timeouts) in the *Amazon EC2 User Guide*.",
       "additionalProperties": false,
       "type": "object",
       "properties": {
diff --git a/internal/aws/cfn/schemas/aws/ec2/networkinterfaceattachment.json b/internal/aws/cfn/schemas/aws/ec2/networkinterfaceattachment.json
index a5b06e51..3fc60170 100644
--- a/internal/aws/cfn/schemas/aws/ec2/networkinterfaceattachment.json
+++ b/internal/aws/cfn/schemas/aws/ec2/networkinterfaceattachment.json
@@ -1,19 +1,19 @@
 {
   "typeName": "AWS::EC2::NetworkInterfaceAttachment",
-  "description": "Resource Type definition for AWS::EC2::NetworkInterfaceAttachment",
+  "description": "Attaches an elastic network interface (ENI) to an Amazon EC2 instance. You can use this resource type to attach additional network interfaces to an instance without interruption.",
   "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-ec2.git",
   "properties": {
     "AttachmentId": {
-      "description": "The ID of the network interface attachment.",
+      "description": "",
       "type": "string"
     },
     "DeleteOnTermination": {
-      "description": "Whether to delete the network interface when the instance terminates. By default, this value is set to true.",
+      "description": "Whether to delete the network interface when the instance terminates. By default, this value is set to ``true``.",
       "type": "boolean",
       "default": true
     },
     "DeviceIndex": {
-      "description": "The network interface's position in the attachment order. For example, the first attached network interface has a DeviceIndex of 0.",
+      "description": "The network interface's position in the attachment order. For example, the first attached network interface has a ``DeviceIndex`` of 0.",
       "type": "string"
     },
     "InstanceId": {
@@ -25,7 +25,8 @@
       "type": "string"
     },
     "EnaSrdSpecification": {
-      "$ref": "#/definitions/EnaSrdSpecification"
+      "$ref": "#/definitions/EnaSrdSpecification",
+      "description": "Configures ENA Express for the network interface that this action attaches to the instance."
     }
   },
   "additionalProperties": false,
@@ -63,7 +64,8 @@
       "additionalProperties": false,
       "properties": {
         "EnaSrdEnabled": {
-          "type": "boolean"
+          "type": "boolean",
+          "description": "Indicates whether ENA Express is enabled for the network interface."
         },
         "EnaSrdUdpSpecification": {
           "type": "object",
@@ -72,9 +74,11 @@
             "EnaSrdUdpEnabled": {
               "type": "boolean"
             }
-          }
+          },
+          "description": "Configures ENA Express for UDP network traffic."
         }
-      }
+      },
+      "description": "ENA Express uses AWS Scalable Reliable Datagram (SRD) technology to increase the maximum bandwidth used per stream and minimize tail latency of network traffic between EC2 instances. With ENA Express, you can communicate between two EC2 instances in the same subnet within the same account, or in different accounts. Both sending and receiving instances must have ENA Express enabled.\n To improve the reliability of network packet delivery, ENA Express reorders network packets on the receiving end by default. However, some UDP-based applications are designed to handle network packets that are out of order to reduce the overhead for packet delivery at the network layer. When ENA Express is enabled, you can specify whether UDP network traffic uses it."
     }
   },
   "handlers": {
diff --git a/internal/aws/cfn/schemas/aws/ec2/subnetcidrblock.json b/internal/aws/cfn/schemas/aws/ec2/subnetcidrblock.json
index 1d2a733c..a94a13c1 100644
--- a/internal/aws/cfn/schemas/aws/ec2/subnetcidrblock.json
+++ b/internal/aws/cfn/schemas/aws/ec2/subnetcidrblock.json
@@ -1,72 +1,41 @@
 {
-  "typeName": "AWS::EC2::SubnetCidrBlock",
-  "$schema": "https://schema.cloudformation.us-east-1.amazonaws.com/provider.definition.schema.v1.json",
-  "description": "The AWS::EC2::SubnetCidrBlock resource creates association between subnet and IPv6 CIDR",
-  "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-ec2/subnetcidrblock",
-  "additionalProperties": false,
-  "properties": {
-    "Id": {
-      "description": "Information about the IPv6 association.",
-      "type": "string"
-    },
-    "Ipv6CidrBlock": {
-      "description": "The IPv6 network range for the subnet, in CIDR notation. The subnet size must use a /64 prefix length",
-      "type": "string",
-      "maxLength": 42
-    },
-    "Ipv6IpamPoolId": {
-      "description": "The ID of an IPv6 Amazon VPC IP Address Manager (IPAM) pool from which to allocate, to get the subnet's CIDR",
-      "type": "string"
-    },
-    "Ipv6NetmaskLength": {
-      "description": "The netmask length of the IPv6 CIDR to allocate to the subnet from an IPAM pool",
-      "type": "integer",
-      "minimum": 0,
-      "maximum": 128
-    },
-    "SubnetId": {
-      "description": "The ID of the subnet",
-      "type": "string"
-    }
+  "tagging": {
+    "taggable": false,
+    "tagOnCreate": false,
+    "tagUpdatable": false,
+    "cloudFormationSystemTags": false
   },
-  "required": [
-    "SubnetId"
+  "$schema": "https://schema.cloudformation.us-east-1.amazonaws.com/provider.definition.schema.v1.json",
+  "typeName": "AWS::EC2::SubnetCidrBlock",
+  "readOnlyProperties": [
+    "/properties/Id"
   ],
+  "description": "The AWS::EC2::SubnetCidrBlock resource creates association between subnet and IPv6 CIDR",
   "createOnlyProperties": [
     "/properties/Ipv6CidrBlock",
     "/properties/SubnetId",
     "/properties/Ipv6IpamPoolId",
     "/properties/Ipv6NetmaskLength"
   ],
-  "readOnlyProperties": [
-    "/properties/Id"
-  ],
-  "writeOnlyProperties": [
-    "/properties/Ipv6IpamPoolId",
-    "/properties/Ipv6NetmaskLength"
-  ],
   "primaryIdentifier": [
     "/properties/Id"
   ],
+  "required": [
+    "SubnetId"
+  ],
+  "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-ec2/subnetcidrblock",
   "propertyTransform": {
     "/properties/Ipv6CidrBlock": "$join([$match($replace(Ipv6CidrBlock, /(^|:)(0{1,4})([0-9a-fA-F]{1,4})/, \"$1$3\"), /^([0-9a-fA-F]{1,4}:){4}/).match, \":/64\"])"
   },
-  "tagging": {
-    "taggable": false,
-    "tagOnCreate": false,
-    "tagUpdatable": false,
-    "cloudFormationSystemTags": false
-  },
   "handlers": {
-    "create": {
+    "read": {
       "permissions": [
-        "ec2:AssociateSubnetCidrBlock",
         "ec2:DescribeSubnets"
       ]
     },
-    "delete": {
+    "create": {
       "permissions": [
-        "ec2:DisassociateSubnetCidrBlock",
+        "ec2:AssociateSubnetCidrBlock",
         "ec2:DescribeSubnets"
       ]
     },
@@ -75,10 +44,41 @@
         "ec2:DescribeSubnets"
       ]
     },
-    "read": {
+    "delete": {
       "permissions": [
+        "ec2:DisassociateSubnetCidrBlock",
         "ec2:DescribeSubnets"
       ]
     }
+  },
+  "writeOnlyProperties": [
+    "/properties/Ipv6IpamPoolId",
+    "/properties/Ipv6NetmaskLength"
+  ],
+  "additionalProperties": false,
+  "properties": {
+    "Ipv6NetmaskLength": {
+      "description": "The netmask length of the IPv6 CIDR to allocate to the subnet from an IPAM pool",
+      "maximum": 128,
+      "type": "integer",
+      "minimum": 0
+    },
+    "Ipv6IpamPoolId": {
+      "description": "The ID of an IPv6 Amazon VPC IP Address Manager (IPAM) pool from which to allocate, to get the subnet's CIDR",
+      "type": "string"
+    },
+    "Id": {
+      "description": "Information about the IPv6 association.",
+      "type": "string"
+    },
+    "SubnetId": {
+      "description": "The ID of the subnet",
+      "type": "string"
+    },
+    "Ipv6CidrBlock": {
+      "description": "The IPv6 network range for the subnet, in CIDR notation. The subnet size must use a /64 prefix length",
+      "type": "string",
+      "maxLength": 42
+    }
   }
 }
diff --git a/internal/aws/cfn/schemas/aws/ec2/trafficmirrorfilterrule.json b/internal/aws/cfn/schemas/aws/ec2/trafficmirrorfilterrule.json
index c68fd7a7..b32298af 100644
--- a/internal/aws/cfn/schemas/aws/ec2/trafficmirrorfilterrule.json
+++ b/internal/aws/cfn/schemas/aws/ec2/trafficmirrorfilterrule.json
@@ -3,9 +3,6 @@
   "description": "Resource Type definition for AWS::EC2::TrafficMirrorFilterRule",
   "additionalProperties": false,
   "properties": {
-    "Id": {
-      "type": "string"
-    },
     "DestinationPortRange": {
       "$ref": "#/definitions/TrafficMirrorPortRange"
     },
@@ -27,6 +24,9 @@
     "DestinationCidrBlock": {
       "type": "string"
     },
+    "Id": {
+      "type": "string"
+    },
     "TrafficMirrorFilterId": {
       "type": "string"
     },
@@ -35,6 +35,13 @@
     },
     "Protocol": {
       "type": "integer"
+    },
+    "Tags": {
+      "type": "array",
+      "uniqueItems": false,
+      "items": {
+        "$ref": "#/definitions/Tag"
+      }
     }
   },
   "definitions": {
@@ -42,16 +49,32 @@
       "type": "object",
       "additionalProperties": false,
       "properties": {
-        "FromPort": {
+        "ToPort": {
           "type": "integer"
         },
-        "ToPort": {
+        "FromPort": {
           "type": "integer"
         }
       },
       "required": [
-        "ToPort",
-        "FromPort"
+        "FromPort",
+        "ToPort"
+      ]
+    },
+    "Tag": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "Value": {
+          "type": "string"
+        },
+        "Key": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "Value",
+        "Key"
       ]
     }
   },
@@ -66,10 +89,10 @@
   "createOnlyProperties": [
     "/properties/TrafficMirrorFilterId"
   ],
-  "readOnlyProperties": [
+  "primaryIdentifier": [
     "/properties/Id"
   ],
-  "primaryIdentifier": [
+  "readOnlyProperties": [
     "/properties/Id"
   ]
 }
diff --git a/internal/aws/cfn/schemas/aws/ec2/vpccidrblock.json b/internal/aws/cfn/schemas/aws/ec2/vpccidrblock.json
index 1172bd00..4d8ca8c2 100644
--- a/internal/aws/cfn/schemas/aws/ec2/vpccidrblock.json
+++ b/internal/aws/cfn/schemas/aws/ec2/vpccidrblock.json
@@ -1,113 +1,113 @@
 {
-  "typeName": "AWS::EC2::VPCCidrBlock",
-  "description": "Resource Type definition for AWS::EC2::VPCCidrBlock",
-  "additionalProperties": false,
-  "properties": {
-    "CidrBlock": {
-      "type": "string",
-      "description": "An IPv4 CIDR block to associate with the VPC."
-    },
-    "Ipv6Pool": {
-      "type": "string",
-      "description": "The ID of an IPv6 address pool from which to allocate the IPv6 CIDR block."
-    },
-    "Id": {
-      "type": "string",
-      "description": "The Id of the VPC associated CIDR Block."
-    },
-    "VpcId": {
-      "type": "string",
-      "description": "The ID of the VPC."
-    },
-    "Ipv6CidrBlock": {
-      "type": "string",
-      "description": "An IPv6 CIDR block from the IPv6 address pool."
-    },
-    "Ipv4IpamPoolId": {
-      "type": "string",
-      "description": "The ID of the IPv4 IPAM pool to Associate a CIDR from to a VPC."
-    },
-    "Ipv4NetmaskLength": {
-      "type": "integer",
-      "description": "The netmask length of the IPv4 CIDR you would like to associate from an Amazon VPC IP Address Manager (IPAM) pool."
-    },
-    "Ipv6IpamPoolId": {
-      "type": "string",
-      "description": "The ID of the IPv6 IPAM pool to Associate a CIDR from to a VPC."
-    },
-    "Ipv6NetmaskLength": {
-      "type": "integer",
-      "description": "The netmask length of the IPv6 CIDR you would like to associate from an Amazon VPC IP Address Manager (IPAM) pool."
-    },
-    "AmazonProvidedIpv6CidrBlock": {
-      "type": "boolean",
-      "description": "Requests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC. You cannot specify the range of IPv6 addresses, or the size of the CIDR block."
-    }
-  },
   "tagging": {
     "taggable": false
   },
-  "required": [
-    "VpcId"
-  ],
-  "createOnlyProperties": [
-    "/properties/Ipv6Pool",
-    "/properties/VpcId",
-    "/properties/AmazonProvidedIpv6CidrBlock",
-    "/properties/Ipv6CidrBlock",
-    "/properties/CidrBlock",
-    "/properties/Ipv4IpamPoolId",
-    "/properties/Ipv4NetmaskLength",
-    "/properties/Ipv6IpamPoolId",
-    "/properties/Ipv6NetmaskLength"
-  ],
-  "primaryIdentifier": [
-    "/properties/Id",
-    "/properties/VpcId"
-  ],
-  "readOnlyProperties": [
-    "/properties/Id"
-  ],
-  "writeOnlyProperties": [
-    "/properties/Ipv4IpamPoolId",
-    "/properties/Ipv4NetmaskLength",
-    "/properties/Ipv6IpamPoolId",
-    "/properties/Ipv6NetmaskLength"
-  ],
   "handlers": {
-    "create": {
-      "permissions": [
-        "ec2:AssociateVpcCidrBlock",
-        "ec2:DescribeVpcs",
-        "ec2:AllocateIpamPoolCidr"
-      ]
-    },
     "read": {
       "permissions": [
         "ec2:DescribeVpcs"
       ]
     },
-    "delete": {
+    "create": {
       "permissions": [
+        "ec2:AssociateVpcCidrBlock",
         "ec2:DescribeVpcs",
-        "ec2:DisassociateVpcCidrBlock"
+        "ec2:AllocateIpamPoolCidr"
       ]
     },
     "list": {
+      "permissions": [
+        "ec2:DescribeVpcs"
+      ],
       "handlerSchema": {
         "properties": {
           "VpcId": {
-            "type": "string",
-            "description": "The ID of the VPC."
+            "description": "The ID of the VPC.",
+            "type": "string"
           }
         },
         "required": [
           "VpcId"
         ]
-      },
+      }
+    },
+    "delete": {
       "permissions": [
-        "ec2:DescribeVpcs"
+        "ec2:DescribeVpcs",
+        "ec2:DisassociateVpcCidrBlock"
       ]
     }
-  }
+  },
+  "typeName": "AWS::EC2::VPCCidrBlock",
+  "readOnlyProperties": [
+    "/properties/Id"
+  ],
+  "description": "Resource Type definition for AWS::EC2::VPCCidrBlock",
+  "writeOnlyProperties": [
+    "/properties/Ipv4IpamPoolId",
+    "/properties/Ipv4NetmaskLength",
+    "/properties/Ipv6IpamPoolId",
+    "/properties/Ipv6NetmaskLength"
+  ],
+  "createOnlyProperties": [
+    "/properties/Ipv6Pool",
+    "/properties/VpcId",
+    "/properties/AmazonProvidedIpv6CidrBlock",
+    "/properties/Ipv6CidrBlock",
+    "/properties/CidrBlock",
+    "/properties/Ipv4IpamPoolId",
+    "/properties/Ipv4NetmaskLength",
+    "/properties/Ipv6IpamPoolId",
+    "/properties/Ipv6NetmaskLength"
+  ],
+  "additionalProperties": false,
+  "primaryIdentifier": [
+    "/properties/Id",
+    "/properties/VpcId"
+  ],
+  "properties": {
+    "Ipv6NetmaskLength": {
+      "description": "The netmask length of the IPv6 CIDR you would like to associate from an Amazon VPC IP Address Manager (IPAM) pool.",
+      "type": "integer"
+    },
+    "Ipv6IpamPoolId": {
+      "description": "The ID of the IPv6 IPAM pool to Associate a CIDR from to a VPC.",
+      "type": "string"
+    },
+    "VpcId": {
+      "description": "The ID of the VPC.",
+      "type": "string"
+    },
+    "Ipv4NetmaskLength": {
+      "description": "The netmask length of the IPv4 CIDR you would like to associate from an Amazon VPC IP Address Manager (IPAM) pool.",
+      "type": "integer"
+    },
+    "CidrBlock": {
+      "description": "An IPv4 CIDR block to associate with the VPC.",
+      "type": "string"
+    },
+    "Ipv6Pool": {
+      "description": "The ID of an IPv6 address pool from which to allocate the IPv6 CIDR block.",
+      "type": "string"
+    },
+    "Ipv4IpamPoolId": {
+      "description": "The ID of the IPv4 IPAM pool to Associate a CIDR from to a VPC.",
+      "type": "string"
+    },
+    "Id": {
+      "description": "The Id of the VPC associated CIDR Block.",
+      "type": "string"
+    },
+    "Ipv6CidrBlock": {
+      "description": "An IPv6 CIDR block from the IPv6 address pool.",
+      "type": "string"
+    },
+    "AmazonProvidedIpv6CidrBlock": {
+      "description": "Requests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC. You cannot specify the range of IPv6 addresses, or the size of the CIDR block.",
+      "type": "boolean"
+    }
+  },
+  "required": [
+    "VpcId"
+  ]
 }
diff --git a/internal/aws/cfn/schemas/aws/ecr/repository.json b/internal/aws/cfn/schemas/aws/ecr/repository.json
index 1fcee857..5c17f199 100644
--- a/internal/aws/cfn/schemas/aws/ecr/repository.json
+++ b/internal/aws/cfn/schemas/aws/ecr/repository.json
@@ -75,7 +75,7 @@
       "properties": {
         "EncryptionType": {
           "$ref": "#/definitions/EncryptionType",
-          "description": "The encryption type to use.\n If you use the ``KMS`` encryption type, the contents of the repository will be encrypted using server-side encryption with KMSlong key stored in KMS. When you use KMS to encrypt your data, you can either use the default AWS managed KMS key for Amazon ECR, or specify your own KMS key, which you already created. For more information, see [Protecting data using server-side encryption with an key stored in (SSE-KMS)](https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingKMSEncryption.html) in the *Amazon Simple Storage Service Console Developer Guide*.\n If you use the ``AES256`` encryption type, Amazon ECR uses server-side encryption with Amazon S3-managed encryption keys which encrypts the images in the repository using an AES-256 encryption algorithm. For more information, see [Protecting data using server-side encryption with Amazon S3-managed encryption keys (SSE-S3)](https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingServerSideEncryption.html) in the *Ama"
+          "description": "The encryption type to use.\n If you use the ``KMS`` encryption type, the contents of the repository will be encrypted using server-side encryption with KMSlong key stored in KMS. When you use KMS to encrypt your data, you can either use the default AWS managed KMS key for Amazon ECR, or specify your own KMS key, which you already created. For more information, see [Protecting data using server-side encryption with an key stored in (SSE-KMS)](https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingKMSEncryption.html) in the *Amazon Simple Storage Service Console Developer Guide*.\n If you use the ``AES256`` encryption type, Amazon ECR uses server-side encryption with Amazon S3-managed encryption keys which encrypts the images in the repository using an AES-256 encryption algorithm. For more information, see [Protecting data using server-side encryption with Amazon S3-managed encryption keys (SSE-S3)](https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingServerSideEncryption.html) in the *Amazon Simple Storage Service Console Developer Guide*."
         },
         "KmsKey": {
           "$ref": "#/definitions/KmsKey",
diff --git a/internal/aws/cfn/schemas/aws/ecr/repositorycreationtemplate.json b/internal/aws/cfn/schemas/aws/ecr/repositorycreationtemplate.json
index c3d5dc8e..b5a87fae 100644
--- a/internal/aws/cfn/schemas/aws/ecr/repositorycreationtemplate.json
+++ b/internal/aws/cfn/schemas/aws/ecr/repositorycreationtemplate.json
@@ -119,6 +119,12 @@
         "$ref": "#/definitions/AppliedForItem"
       }
     },
+    "CustomRoleArn": {
+      "type": "string",
+      "description": "The ARN of the role to be assumed by ECR. This role must be in the same account as the registry that you are configuring.",
+      "maxLength": 2048,
+      "pattern": "^arn:aws[-a-z0-9]*:iam::[0-9]{12}:role/[A-Za-z0-9+=,-.@_]*$"
+    },
     "CreatedAt": {
       "description": "Create timestamp of the template.",
       "type": "string"
@@ -149,7 +155,8 @@
         "ecr:PutLifecyclePolicy",
         "ecr:SetRepositoryPolicy",
         "ecr:CreateRepository",
-        "iam:CreateServiceLinkedRole"
+        "iam:CreateServiceLinkedRole",
+        "iam:PassRole"
       ]
     },
     "read": {
@@ -164,7 +171,8 @@
         "ecr:PutLifecyclePolicy",
         "ecr:SetRepositoryPolicy",
         "ecr:CreateRepository",
-        "iam:CreateServiceLinkedRole"
+        "iam:CreateServiceLinkedRole",
+        "iam:PassRole"
       ]
     },
     "delete": {
diff --git a/internal/aws/cfn/schemas/aws/eks/cluster.json b/internal/aws/cfn/schemas/aws/eks/cluster.json
index e73b8a5c..4df55e55 100644
--- a/internal/aws/cfn/schemas/aws/eks/cluster.json
+++ b/internal/aws/cfn/schemas/aws/eks/cluster.json
@@ -1,107 +1,177 @@
 {
+  "tagging": {
+    "taggable": true,
+    "tagOnCreate": true,
+    "tagUpdatable": true,
+    "tagProperty": "/properties/Tags",
+    "cloudFormationSystemTags": true
+  },
   "typeName": "AWS::EKS::Cluster",
+  "readOnlyProperties": [
+    "/properties/Id",
+    "/properties/Arn",
+    "/properties/Endpoint",
+    "/properties/CertificateAuthorityData",
+    "/properties/ClusterSecurityGroupId",
+    "/properties/EncryptionConfigKeyArn",
+    "/properties/OpenIdConnectIssuerUrl",
+    "/properties/KubernetesNetworkConfig/ServiceIpv6Cidr"
+  ],
   "description": "An object representing an Amazon EKS cluster.",
+  "createOnlyProperties": [
+    "/properties/OutpostConfig",
+    "/properties/EncryptionConfig",
+    "/properties/KubernetesNetworkConfig",
+    "/properties/AccessConfig/BootstrapClusterCreatorAdminPermissions",
+    "/properties/Name",
+    "/properties/RoleArn",
+    "/properties/BootstrapSelfManagedAddons"
+  ],
+  "primaryIdentifier": [
+    "/properties/Name"
+  ],
+  "required": [
+    "RoleArn",
+    "ResourcesVpcConfig"
+  ],
   "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-eks.git",
+  "handlers": {
+    "read": {
+      "permissions": [
+        "eks:DescribeCluster"
+      ]
+    },
+    "create": {
+      "permissions": [
+        "eks:CreateCluster",
+        "eks:DescribeCluster",
+        "eks:TagResource",
+        "iam:PassRole",
+        "iam:GetRole",
+        "iam:ListAttachedRolePolicies",
+        "iam:CreateServiceLinkedRole",
+        "iam:CreateInstanceProfile",
+        "iam:TagInstanceProfile",
+        "iam:AddRoleToInstanceProfile",
+        "iam:GetInstanceProfile",
+        "iam:DeleteInstanceProfile",
+        "iam:RemoveRoleFromInstanceProfile",
+        "ec2:DescribeSubnets",
+        "ec2:DescribeVpcs",
+        "kms:DescribeKey",
+        "kms:CreateGrant"
+      ]
+    },
+    "update": {
+      "permissions": [
+        "iam:PassRole",
+        "eks:UpdateClusterConfig",
+        "eks:UpdateClusterVersion",
+        "eks:DescribeCluster",
+        "eks:DescribeUpdate",
+        "eks:TagResource",
+        "eks:UntagResource"
+      ],
+      "timeoutInMinutes": 180
+    },
+    "list": {
+      "permissions": [
+        "eks:ListClusters"
+      ]
+    },
+    "delete": {
+      "permissions": [
+        "eks:DeleteCluster",
+        "eks:DescribeCluster"
+      ]
+    }
+  },
+  "writeOnlyProperties": [
+    "/properties/AccessConfig/BootstrapClusterCreatorAdminPermissions",
+    "/properties/BootstrapSelfManagedAddons"
+  ],
+  "additionalProperties": false,
   "definitions": {
-    "Tag": {
-      "description": "A key-value pair to associate with a resource.",
+    "Logging": {
+      "description": "Enable exporting the Kubernetes control plane logs for your cluster to CloudWatch Logs based on log types. By default, cluster control plane logs aren't exported to CloudWatch Logs.",
+      "additionalProperties": false,
       "type": "object",
       "properties": {
-        "Key": {
-          "type": "string",
-          "description": "The key name of the tag. You can specify a value that is 1 to 128 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -.",
-          "minLength": 1,
-          "maxLength": 128
-        },
-        "Value": {
-          "type": "string",
-          "description": "The value for the tag. You can specify a value that is 0 to 256 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -.",
-          "minLength": 0,
-          "maxLength": 256
+        "ClusterLogging": {
+          "description": "The cluster control plane logging configuration for your cluster. ",
+          "$ref": "#/definitions/ClusterLogging"
         }
-      },
-      "required": [
-        "Key",
-        "Value"
-      ],
-      "additionalProperties": false
+      }
     },
-    "Provider": {
-      "type": "object",
+    "RemoteNodeNetworks": {
+      "description": "Network configuration of nodes run on-premises with EKS Hybrid Nodes.",
+      "insertionOrder": false,
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/RemoteNodeNetwork"
+      }
+    },
+    "EnabledTypes": {
+      "description": "Enable control plane logs for your cluster, all log types will be disabled if the array is empty",
+      "insertionOrder": false,
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/LoggingTypeConfig"
+      }
+    },
+    "ControlPlanePlacement": {
+      "description": "Specify the placement group of the control plane machines for your cluster.",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
-        "KeyArn": {
-          "description": "Amazon Resource Name (ARN) or alias of the KMS key. The KMS key must be symmetric, created in the same region as the cluster, and if the KMS key was created in a different account, the user must have access to the KMS key.",
+        "GroupName": {
+          "description": "Specify the placement group name of the control place machines for your cluster.",
           "type": "string"
         }
       }
     },
-    "EncryptionConfig": {
-      "description": "The encryption configuration for the cluster",
+    "AccessConfig": {
+      "description": "An object representing the Access Config to use for the cluster.",
+      "additionalProperties": false,
       "type": "object",
       "properties": {
-        "Provider": {
-          "description": "The encryption provider for the cluster.",
-          "$ref": "#/definitions/Provider"
+        "AuthenticationMode": {
+          "description": "Specify the authentication mode that should be used to create your cluster.",
+          "type": "string",
+          "enum": [
+            "CONFIG_MAP",
+            "API_AND_CONFIG_MAP",
+            "API"
+          ]
         },
-        "Resources": {
-          "description": "Specifies the resources to be encrypted. The only supported value is \"secrets\".",
-          "type": "array",
-          "insertionOrder": false,
-          "items": {
-            "type": "string"
-          }
+        "BootstrapClusterCreatorAdminPermissions": {
+          "description": "Set this value to false to avoid creating a default cluster admin Access Entry using the IAM principal used to create the cluster.",
+          "type": "boolean"
         }
-      },
-      "additionalProperties": false
+      }
     },
-    "ResourcesVpcConfig": {
-      "description": "An object representing the VPC configuration to use for an Amazon EKS cluster.",
-      "type": "object",
+    "EncryptionConfig": {
+      "description": "The encryption configuration for the cluster",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
-        "EndpointPrivateAccess": {
-          "description": "Set this value to true to enable private access for your cluster's Kubernetes API server endpoint. If you enable private access, Kubernetes API requests from within your cluster's VPC use the private VPC endpoint. The default value for this parameter is false, which disables private access for your Kubernetes API server. If you disable private access and you have nodes or AWS Fargate pods in the cluster, then ensure that publicAccessCidrs includes the necessary CIDR blocks for communication with the nodes or Fargate pods.",
-          "type": "boolean"
-        },
-        "EndpointPublicAccess": {
-          "description": "Set this value to false to disable public access to your cluster's Kubernetes API server endpoint. If you disable public access, your cluster's Kubernetes API server can only receive requests from within the cluster VPC. The default value for this parameter is true, which enables public access for your Kubernetes API server.",
-          "type": "boolean"
-        },
-        "PublicAccessCidrs": {
-          "description": "The CIDR blocks that are allowed access to your cluster's public Kubernetes API server endpoint. Communication to the endpoint from addresses outside of the CIDR blocks that you specify is denied. The default value is 0.0.0.0/0. If you've disabled private endpoint access and you have nodes or AWS Fargate pods in the cluster, then ensure that you specify the necessary CIDR blocks.",
-          "type": "array",
+        "Resources": {
+          "description": "Specifies the resources to be encrypted. The only supported value is \"secrets\".",
           "insertionOrder": false,
-          "items": {
-            "type": "string",
-            "minItems": 1
-          }
-        },
-        "SecurityGroupIds": {
-          "description": "Specify one or more security groups for the cross-account elastic network interfaces that Amazon EKS creates to use to allow communication between your worker nodes and the Kubernetes control plane. If you don't specify a security group, the default security group for your VPC is used.",
           "type": "array",
-          "insertionOrder": false,
           "items": {
-            "type": "string",
-            "minItems": 1
+            "type": "string"
           }
         },
-        "SubnetIds": {
-          "description": "Specify subnets for your Amazon EKS nodes. Amazon EKS creates cross-account elastic network interfaces in these subnets to allow communication between your nodes and the Kubernetes control plane.",
-          "type": "array",
-          "insertionOrder": false,
-          "items": {
-            "type": "string",
-            "minItems": 1
-          }
+        "Provider": {
+          "description": "The encryption provider for the cluster.",
+          "$ref": "#/definitions/Provider"
         }
-      },
-      "required": [
-        "SubnetIds"
-      ]
+      }
     },
     "LoggingTypeConfig": {
       "description": "Enabled Logging Type",
+      "additionalProperties": false,
       "type": "object",
       "properties": {
         "Type": {
@@ -115,38 +185,18 @@
             "scheduler"
           ]
         }
-      },
-      "additionalProperties": false
-    },
-    "EnabledTypes": {
-      "description": "Enable control plane logs for your cluster, all log types will be disabled if the array is empty",
-      "type": "array",
-      "insertionOrder": false,
-      "items": {
-        "$ref": "#/definitions/LoggingTypeConfig"
       }
     },
     "ClusterLogging": {
       "description": "The cluster control plane logging configuration for your cluster. ",
-      "type": "object",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
         "EnabledTypes": {
           "$ref": "#/definitions/EnabledTypes"
         }
       }
     },
-    "Logging": {
-      "description": "Enable exporting the Kubernetes control plane logs for your cluster to CloudWatch Logs based on log types. By default, cluster control plane logs aren't exported to CloudWatch Logs.",
-      "type": "object",
-      "additionalProperties": false,
-      "properties": {
-        "ClusterLogging": {
-          "description": "The cluster control plane logging configuration for your cluster. ",
-          "$ref": "#/definitions/ClusterLogging"
-        }
-      }
-    },
     "KubernetesNetworkConfig": {
       "description": "The Kubernetes network configuration for the cluster.",
       "additionalProperties": false,
@@ -170,235 +220,257 @@
         }
       }
     },
-    "ControlPlanePlacement": {
-      "description": "Specify the placement group of the control plane machines for your cluster.",
-      "type": "object",
+    "Provider": {
       "additionalProperties": false,
+      "type": "object",
       "properties": {
-        "GroupName": {
-          "description": "Specify the placement group name of the control place machines for your cluster.",
+        "KeyArn": {
+          "description": "Amazon Resource Name (ARN) or alias of the KMS key. The KMS key must be symmetric, created in the same region as the cluster, and if the KMS key was created in a different account, the user must have access to the KMS key.",
           "type": "string"
         }
       }
     },
-    "OutpostConfig": {
-      "description": "An object representing the Outpost configuration to use for AWS EKS outpost cluster.",
+    "RemoteNodeNetwork": {
+      "description": "Network configuration of nodes run on-premises with EKS Hybrid Nodes.",
       "additionalProperties": false,
       "type": "object",
       "properties": {
-        "OutpostArns": {
-          "description": "Specify one or more Arn(s) of Outpost(s) on which you would like to create your cluster.",
-          "type": "array",
+        "Cidrs": {
+          "description": "Specifies the list of remote node CIDRs.",
           "insertionOrder": false,
+          "type": "array",
           "items": {
-            "type": "string",
-            "minItems": 1
+            "minItems": 1,
+            "type": "string"
           }
-        },
-        "ControlPlaneInstanceType": {
-          "description": "Specify the Instance type of the machines that should be used to create your cluster.",
-          "type": "string"
-        },
-        "ControlPlanePlacement": {
-          "description": "Specify the placement group of the control plane machines for your cluster.",
-          "$ref": "#/definitions/ControlPlanePlacement"
         }
       },
       "required": [
-        "OutpostArns",
-        "ControlPlaneInstanceType"
+        "Cidrs"
       ]
     },
-    "AccessConfig": {
-      "description": "An object representing the Access Config to use for the cluster.",
+    "UpgradePolicy": {
+      "description": "An object representing the Upgrade Policy to use for the cluster.",
       "additionalProperties": false,
       "type": "object",
       "properties": {
-        "BootstrapClusterCreatorAdminPermissions": {
-          "description": "Set this value to false to avoid creating a default cluster admin Access Entry using the IAM principal used to create the cluster.",
-          "type": "boolean"
-        },
-        "AuthenticationMode": {
-          "description": "Specify the authentication mode that should be used to create your cluster.",
+        "SupportType": {
+          "description": "Specify the support type for your cluster.",
           "type": "string",
           "enum": [
-            "CONFIG_MAP",
-            "API_AND_CONFIG_MAP",
-            "API"
+            "STANDARD",
+            "EXTENDED"
           ]
         }
       }
-    }
-  },
-  "properties": {
-    "EncryptionConfig": {
-      "type": "array",
+    },
+    "RemotePodNetworks": {
+      "description": "Network configuration of pods run on-premises with EKS Hybrid Nodes.",
       "insertionOrder": false,
+      "type": "array",
       "items": {
-        "$ref": "#/definitions/EncryptionConfig",
-        "maxItems": 1
+        "$ref": "#/definitions/RemotePodNetwork"
       }
     },
-    "KubernetesNetworkConfig": {
-      "$ref": "#/definitions/KubernetesNetworkConfig"
+    "Tag": {
+      "description": "A key-value pair to associate with a resource.",
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+        "Value": {
+          "minLength": 0,
+          "description": "The value for the tag. You can specify a value that is 0 to 256 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -.",
+          "type": "string",
+          "maxLength": 256
+        },
+        "Key": {
+          "minLength": 1,
+          "description": "The key name of the tag. You can specify a value that is 1 to 128 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -.",
+          "type": "string",
+          "maxLength": 128
+        }
+      },
+      "required": [
+        "Key",
+        "Value"
+      ]
     },
+    "OutpostConfig": {
+      "description": "An object representing the Outpost configuration to use for AWS EKS outpost cluster.",
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+        "OutpostArns": {
+          "description": "Specify one or more Arn(s) of Outpost(s) on which you would like to create your cluster.",
+          "insertionOrder": false,
+          "type": "array",
+          "items": {
+            "minItems": 1,
+            "type": "string"
+          }
+        },
+        "ControlPlanePlacement": {
+          "description": "Specify the placement group of the control plane machines for your cluster.",
+          "$ref": "#/definitions/ControlPlanePlacement"
+        },
+        "ControlPlaneInstanceType": {
+          "description": "Specify the Instance type of the machines that should be used to create your cluster.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "OutpostArns",
+        "ControlPlaneInstanceType"
+      ]
+    },
+    "ResourcesVpcConfig": {
+      "description": "An object representing the VPC configuration to use for an Amazon EKS cluster.",
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+        "EndpointPublicAccess": {
+          "description": "Set this value to false to disable public access to your cluster's Kubernetes API server endpoint. If you disable public access, your cluster's Kubernetes API server can only receive requests from within the cluster VPC. The default value for this parameter is true, which enables public access for your Kubernetes API server.",
+          "type": "boolean"
+        },
+        "PublicAccessCidrs": {
+          "description": "The CIDR blocks that are allowed access to your cluster's public Kubernetes API server endpoint. Communication to the endpoint from addresses outside of the CIDR blocks that you specify is denied. The default value is 0.0.0.0/0. If you've disabled private endpoint access and you have nodes or AWS Fargate pods in the cluster, then ensure that you specify the necessary CIDR blocks.",
+          "insertionOrder": false,
+          "type": "array",
+          "items": {
+            "minItems": 1,
+            "type": "string"
+          }
+        },
+        "EndpointPrivateAccess": {
+          "description": "Set this value to true to enable private access for your cluster's Kubernetes API server endpoint. If you enable private access, Kubernetes API requests from within your cluster's VPC use the private VPC endpoint. The default value for this parameter is false, which disables private access for your Kubernetes API server. If you disable private access and you have nodes or AWS Fargate pods in the cluster, then ensure that publicAccessCidrs includes the necessary CIDR blocks for communication with the nodes or Fargate pods.",
+          "type": "boolean"
+        },
+        "SecurityGroupIds": {
+          "description": "Specify one or more security groups for the cross-account elastic network interfaces that Amazon EKS creates to use to allow communication between your worker nodes and the Kubernetes control plane. If you don't specify a security group, the default security group for your VPC is used.",
+          "insertionOrder": false,
+          "type": "array",
+          "items": {
+            "minItems": 1,
+            "type": "string"
+          }
+        },
+        "SubnetIds": {
+          "description": "Specify subnets for your Amazon EKS nodes. Amazon EKS creates cross-account elastic network interfaces in these subnets to allow communication between your nodes and the Kubernetes control plane.",
+          "insertionOrder": false,
+          "type": "array",
+          "items": {
+            "minItems": 1,
+            "type": "string"
+          }
+        }
+      },
+      "required": [
+        "SubnetIds"
+      ]
+    },
+    "RemotePodNetwork": {
+      "description": "Network configuration of pods run on-premises with EKS Hybrid Nodes.",
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+        "Cidrs": {
+          "description": "Specifies the list of remote pod CIDRs.",
+          "insertionOrder": false,
+          "type": "array",
+          "items": {
+            "minItems": 1,
+            "type": "string"
+          }
+        }
+      },
+      "required": [
+        "Cidrs"
+      ]
+    }
+  },
+  "properties": {
     "Logging": {
       "$ref": "#/definitions/Logging"
     },
-    "Name": {
-      "description": "The unique name to give to your cluster.",
-      "type": "string",
-      "pattern": "^[0-9A-Za-z][A-Za-z0-9\\-_]*",
-      "minLength": 1,
-      "maxLength": 100
+    "BootstrapSelfManagedAddons": {
+      "description": "Set this value to false to avoid creating the default networking addons when the cluster is created.",
+      "type": "boolean"
     },
-    "Id": {
-      "description": "The unique ID given to your cluster.",
+    "EncryptionConfigKeyArn": {
+      "description": "Amazon Resource Name (ARN) or alias of the customer master key (CMK).",
       "type": "string"
     },
-    "ResourcesVpcConfig": {
-      "$ref": "#/definitions/ResourcesVpcConfig"
-    },
-    "OutpostConfig": {
-      "$ref": "#/definitions/OutpostConfig"
-    },
     "AccessConfig": {
       "$ref": "#/definitions/AccessConfig"
     },
-    "RoleArn": {
-      "description": "The Amazon Resource Name (ARN) of the IAM role that provides permissions for the Kubernetes control plane to make calls to AWS API operations on your behalf.",
+    "CertificateAuthorityData": {
+      "description": "The certificate-authority-data for your cluster.",
       "type": "string"
     },
-    "Version": {
-      "description": "The desired Kubernetes version for your cluster. If you don't specify a value here, the latest version available in Amazon EKS is used.",
-      "type": "string",
-      "pattern": "1\\.\\d\\d"
-    },
-    "Tags": {
-      "description": "An array of key-value pairs to apply to this resource.",
-      "type": "array",
-      "uniqueItems": true,
+    "EncryptionConfig": {
       "insertionOrder": false,
+      "type": "array",
       "items": {
-        "$ref": "#/definitions/Tag"
+        "maxItems": 1,
+        "$ref": "#/definitions/EncryptionConfig"
       }
     },
-    "Arn": {
-      "description": "The ARN of the cluster, such as arn:aws:eks:us-west-2:666666666666:cluster/prod.",
+    "KubernetesNetworkConfig": {
+      "$ref": "#/definitions/KubernetesNetworkConfig"
+    },
+    "RoleArn": {
+      "description": "The Amazon Resource Name (ARN) of the IAM role that provides permissions for the Kubernetes control plane to make calls to AWS API operations on your behalf.",
       "type": "string"
     },
+    "Name": {
+      "minLength": 1,
+      "pattern": "^[0-9A-Za-z][A-Za-z0-9\\-_]*",
+      "description": "The unique name to give to your cluster.",
+      "type": "string",
+      "maxLength": 100
+    },
+    "UpgradePolicy": {
+      "$ref": "#/definitions/UpgradePolicy"
+    },
     "Endpoint": {
       "description": "The endpoint for your Kubernetes API server, such as https://5E1D0CEXAMPLEA591B746AFC5AB30262.yl4.us-west-2.eks.amazonaws.com.",
       "type": "string"
     },
-    "CertificateAuthorityData": {
-      "description": "The certificate-authority-data for your cluster.",
+    "Version": {
+      "pattern": "1\\.\\d\\d",
+      "description": "The desired Kubernetes version for your cluster. If you don't specify a value here, the latest version available in Amazon EKS is used.",
       "type": "string"
     },
     "ClusterSecurityGroupId": {
       "description": "The cluster security group that was created by Amazon EKS for the cluster. Managed node groups use this security group for control plane to data plane communication.",
       "type": "string"
     },
-    "EncryptionConfigKeyArn": {
-      "description": "Amazon Resource Name (ARN) or alias of the customer master key (CMK).",
-      "type": "string"
-    },
-    "OpenIdConnectIssuerUrl": {
-      "description": "The issuer URL for the cluster's OIDC identity provider, such as https://oidc.eks.us-west-2.amazonaws.com/id/EXAMPLED539D4633E53DE1B716D3041E. If you need to remove https:// from this output value, you can include the following code in your template.",
+    "Id": {
+      "description": "The unique ID given to your cluster.",
       "type": "string"
     },
-    "BootstrapSelfManagedAddons": {
-      "description": "Set this value to false to avoid creating the default networking addons when the cluster is created.",
-      "type": "boolean"
-    }
-  },
-  "tagging": {
-    "taggable": true,
-    "tagOnCreate": true,
-    "tagUpdatable": true,
-    "cloudFormationSystemTags": true,
-    "tagProperty": "/properties/Tags"
-  },
-  "additionalProperties": false,
-  "required": [
-    "RoleArn",
-    "ResourcesVpcConfig"
-  ],
-  "primaryIdentifier": [
-    "/properties/Name"
-  ],
-  "createOnlyProperties": [
-    "/properties/OutpostConfig",
-    "/properties/EncryptionConfig",
-    "/properties/KubernetesNetworkConfig",
-    "/properties/AccessConfig/BootstrapClusterCreatorAdminPermissions",
-    "/properties/Name",
-    "/properties/RoleArn",
-    "/properties/BootstrapSelfManagedAddons"
-  ],
-  "readOnlyProperties": [
-    "/properties/Id",
-    "/properties/Arn",
-    "/properties/Endpoint",
-    "/properties/CertificateAuthorityData",
-    "/properties/ClusterSecurityGroupId",
-    "/properties/EncryptionConfigKeyArn",
-    "/properties/OpenIdConnectIssuerUrl",
-    "/properties/KubernetesNetworkConfig/ServiceIpv6Cidr"
-  ],
-  "writeOnlyProperties": [
-    "/properties/AccessConfig/BootstrapClusterCreatorAdminPermissions",
-    "/properties/BootstrapSelfManagedAddons"
-  ],
-  "handlers": {
-    "create": {
-      "permissions": [
-        "eks:CreateCluster",
-        "eks:DescribeCluster",
-        "eks:TagResource",
-        "iam:PassRole",
-        "iam:GetRole",
-        "iam:ListAttachedRolePolicies",
-        "iam:CreateServiceLinkedRole",
-        "iam:CreateInstanceProfile",
-        "iam:TagInstanceProfile",
-        "iam:AddRoleToInstanceProfile",
-        "iam:GetInstanceProfile",
-        "iam:DeleteInstanceProfile",
-        "iam:RemoveRoleFromInstanceProfile",
-        "ec2:DescribeSubnets",
-        "ec2:DescribeVpcs",
-        "kms:DescribeKey",
-        "kms:CreateGrant"
-      ]
+    "OutpostConfig": {
+      "$ref": "#/definitions/OutpostConfig"
     },
-    "read": {
-      "permissions": [
-        "eks:DescribeCluster"
-      ]
+    "Arn": {
+      "description": "The ARN of the cluster, such as arn:aws:eks:us-west-2:666666666666:cluster/prod.",
+      "type": "string"
     },
-    "update": {
-      "permissions": [
-        "iam:PassRole",
-        "eks:UpdateClusterConfig",
-        "eks:UpdateClusterVersion",
-        "eks:DescribeCluster",
-        "eks:DescribeUpdate",
-        "eks:TagResource",
-        "eks:UntagResource"
-      ],
-      "timeoutInMinutes": 180
+    "ResourcesVpcConfig": {
+      "$ref": "#/definitions/ResourcesVpcConfig"
     },
-    "delete": {
-      "permissions": [
-        "eks:DeleteCluster",
-        "eks:DescribeCluster"
-      ]
+    "Tags": {
+      "uniqueItems": true,
+      "description": "An array of key-value pairs to apply to this resource.",
+      "insertionOrder": false,
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/Tag"
+      }
     },
-    "list": {
-      "permissions": [
-        "eks:ListClusters"
-      ]
+    "OpenIdConnectIssuerUrl": {
+      "description": "The issuer URL for the cluster's OIDC identity provider, such as https://oidc.eks.us-west-2.amazonaws.com/id/EXAMPLED539D4633E53DE1B716D3041E. If you need to remove https:// from this output value, you can include the following code in your template.",
+      "type": "string"
     }
   }
 }
diff --git a/internal/aws/cfn/schemas/aws/eks/nodegroup.json b/internal/aws/cfn/schemas/aws/eks/nodegroup.json
index 30d164ed..213bda61 100644
--- a/internal/aws/cfn/schemas/aws/eks/nodegroup.json
+++ b/internal/aws/cfn/schemas/aws/eks/nodegroup.json
@@ -215,7 +215,11 @@
     "tagOnCreate": true,
     "tagUpdatable": true,
     "cloudFormationSystemTags": true,
-    "tagProperty": "/properties/Tags"
+    "tagProperty": "/properties/Tags",
+    "permissions": [
+      "eks:TagResource",
+      "eks:UntagResource"
+    ]
   },
   "required": [
     "ClusterName",
diff --git a/internal/aws/cfn/schemas/aws/entityresolution/idmappingworkflow.json b/internal/aws/cfn/schemas/aws/entityresolution/idmappingworkflow.json
index 15916116..3863fd88 100644
--- a/internal/aws/cfn/schemas/aws/entityresolution/idmappingworkflow.json
+++ b/internal/aws/cfn/schemas/aws/entityresolution/idmappingworkflow.json
@@ -1,122 +1,173 @@
 {
+  "tagging": {
+    "taggable": true,
+    "tagOnCreate": true,
+    "tagUpdatable": true,
+    "tagProperty": "/properties/Tags",
+    "cloudFormationSystemTags": true
+  },
   "typeName": "AWS::EntityResolution::IdMappingWorkflow",
+  "readOnlyProperties": [
+    "/properties/WorkflowArn",
+    "/properties/UpdatedAt",
+    "/properties/CreatedAt"
+  ],
   "description": "IdMappingWorkflow defined in AWS Entity Resolution service",
+  "createOnlyProperties": [
+    "/properties/WorkflowName"
+  ],
+  "primaryIdentifier": [
+    "/properties/WorkflowName"
+  ],
+  "required": [
+    "WorkflowName",
+    "InputSourceConfig",
+    "IdMappingTechniques",
+    "RoleArn"
+  ],
   "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-entity-resolution.git",
-  "definitions": {
-    "EntityName": {
-      "type": "string",
-      "pattern": "^[a-zA-Z_0-9-]*$",
-      "minLength": 0,
-      "maxLength": 255
+  "handlers": {
+    "read": {
+      "permissions": [
+        "entityresolution:GetIdMappingWorkflow",
+        "entityresolution:ListTagsForResource"
+      ]
     },
-    "Description": {
-      "type": "string",
-      "minLength": 0,
-      "maxLength": 255
+    "create": {
+      "permissions": [
+        "entityresolution:CreateIdMappingWorkflow",
+        "entityresolution:GetIdMappingWorkflow",
+        "entityresolution:TagResource",
+        "kms:CreateGrant",
+        "kms:DescribeKey",
+        "iam:PassRole"
+      ]
     },
-    "AttributeName": {
-      "type": "string",
-      "pattern": "^[a-zA-Z_0-9- \\t]*$",
-      "minLength": 0,
-      "maxLength": 255
+    "update": {
+      "permissions": [
+        "entityresolution:GetIdMappingWorkflow",
+        "entityresolution:UpdateIdMappingWorkflow",
+        "entityresolution:ListTagsForResource",
+        "entityresolution:TagResource",
+        "entityresolution:UntagResource",
+        "iam:PassRole",
+        "kms:CreateGrant",
+        "kms:DescribeKey"
+      ]
     },
-    "SchemaMappingArn": {
-      "description": "The SchemaMapping arn associated with the Schema",
-      "type": "string",
-      "pattern": "^arn:(aws|aws-us-gov|aws-cn):entityresolution:.*:[0-9]+:(schemamapping/.*)$"
+    "list": {
+      "permissions": [
+        "entityresolution:ListIdMappingWorkflows"
+      ]
     },
-    "KMSArn": {
-      "type": "string",
-      "pattern": "^arn:(aws|aws-us-gov|aws-cn):kms:.*:[0-9]+:.*$"
+    "delete": {
+      "permissions": [
+        "entityresolution:DeleteIdMappingWorkflow",
+        "entityresolution:GetIdMappingWorkflow",
+        "entityresolution:UntagResource"
+      ]
+    }
+  },
+  "writeOnlyProperties": [
+    "/properties/IdMappingTechniques/NormalizationVersion"
+  ],
+  "additionalProperties": false,
+  "definitions": {
+    "IdMappingWorkflowOutputSource": {
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+        "KMSArn": {
+          "$ref": "#/definitions/KMSArn"
+        },
+        "OutputS3Path": {
+          "pattern": "^s3://([^/]+)/?(.*?([^/]+)/?)$",
+          "description": "The S3 path to which Entity Resolution will write the output table",
+          "type": "string"
+        }
+      },
+      "required": [
+        "OutputS3Path"
+      ]
     },
-    "IdMappingWorkflowArn": {
-      "description": "The default IdMappingWorkflow arn",
+    "Description": {
+      "minLength": 0,
       "type": "string",
-      "pattern": "^arn:(aws|aws-us-gov|aws-cn):entityresolution:.*:[0-9]+:(idmappingworkflow/.*)$"
-    },
-    "CreatedAt": {
-      "description": "The time of this IdMappingWorkflow got created",
-      "type": "string"
-    },
-    "UpdatedAt": {
-      "description": "The time of this IdMappingWorkflow got last updated at",
-      "type": "string"
+      "maxLength": 255
     },
     "IdMappingWorkflowInputSource": {
+      "additionalProperties": false,
       "type": "object",
       "properties": {
-        "InputSourceARN": {
-          "description": "An Glue table ARN for the input source table, MatchingWorkflow arn or IdNamespace ARN",
-          "type": "string",
-          "pattern": "^arn:(aws|aws-us-gov|aws-cn):entityresolution:[a-z]{2}-[a-z]{1,10}-[0-9]:[0-9]{12}:(idnamespace/[a-zA-Z_0-9-]{1,255})$|^arn:(aws|aws-us-gov|aws-cn):entityresolution:[a-z]{2}-[a-z]{1,10}-[0-9]:[0-9]{12}:(matchingworkflow/[a-zA-Z_0-9-]{1,255})$|^arn:(aws|aws-us-gov|aws-cn):glue:[a-z]{2}-[a-z]{1,10}-[0-9]:[0-9]{12}:(table/[a-zA-Z_0-9-]{1,255}/[a-zA-Z_0-9-]{1,255})$"
-        },
-        "SchemaArn": {
-          "type": "string",
-          "$ref": "#/definitions/SchemaMappingArn"
-        },
         "Type": {
           "type": "string",
           "enum": [
             "SOURCE",
             "TARGET"
           ]
+        },
+        "InputSourceARN": {
+          "pattern": "^arn:(aws|aws-us-gov|aws-cn):entityresolution:[a-z]{2}-[a-z]{1,10}-[0-9]:[0-9]{12}:(idnamespace/[a-zA-Z_0-9-]{1,255})$|^arn:(aws|aws-us-gov|aws-cn):entityresolution:[a-z]{2}-[a-z]{1,10}-[0-9]:[0-9]{12}:(matchingworkflow/[a-zA-Z_0-9-]{1,255})$|^arn:(aws|aws-us-gov|aws-cn):glue:[a-z]{2}-[a-z]{1,10}-[0-9]:[0-9]{12}:(table/[a-zA-Z_0-9-]{1,255}/[a-zA-Z_0-9-]{1,255})$",
+          "description": "An Glue table ARN for the input source table, MatchingWorkflow arn or IdNamespace ARN",
+          "type": "string"
+        },
+        "SchemaArn": {
+          "type": "string",
+          "$ref": "#/definitions/SchemaMappingArn"
         }
       },
       "required": [
         "InputSourceARN"
-      ],
-      "additionalProperties": false
+      ]
     },
-    "IdMappingWorkflowOutputSource": {
-      "type": "object",
-      "properties": {
-        "OutputS3Path": {
-          "description": "The S3 path to which Entity Resolution will write the output table",
-          "type": "string",
-          "pattern": "^s3://([^/]+)/?(.*?([^/]+)/?)$"
-        },
-        "KMSArn": {
-          "$ref": "#/definitions/KMSArn"
-        }
-      },
-      "required": [
-        "OutputS3Path"
-      ],
-      "additionalProperties": false
+    "EntityName": {
+      "minLength": 0,
+      "pattern": "^[a-zA-Z_0-9-]*$",
+      "type": "string",
+      "maxLength": 255
     },
     "IdMappingTechniques": {
+      "additionalProperties": false,
       "type": "object",
       "properties": {
+        "RuleBasedProperties": {
+          "$ref": "#/definitions/IdMappingRuleBasedProperties"
+        },
+        "ProviderProperties": {
+          "$ref": "#/definitions/ProviderProperties"
+        },
         "IdMappingType": {
           "type": "string",
           "enum": [
             "PROVIDER",
             "RULE_BASED"
           ]
-        },
-        "NormalizationVersion": {
-          "type": "string"
-        },
-        "RuleBasedProperties": {
-          "$ref": "#/definitions/IdMappingRuleBasedProperties"
-        },
-        "ProviderProperties": {
-          "$ref": "#/definitions/ProviderProperties"
         }
-      },
-      "additionalProperties": false
+      }
+    },
+    "CreatedAt": {
+      "description": "The time of this IdMappingWorkflow got created",
+      "type": "string"
+    },
+    "IdMappingWorkflowArn": {
+      "pattern": "^arn:(aws|aws-us-gov|aws-cn):entityresolution:.*:[0-9]+:(idmappingworkflow/.*)$",
+      "description": "The default IdMappingWorkflow arn",
+      "type": "string"
+    },
+    "UpdatedAt": {
+      "description": "The time of this IdMappingWorkflow got last updated at",
+      "type": "string"
     },
     "IdMappingRuleBasedProperties": {
+      "additionalProperties": false,
       "type": "object",
       "properties": {
-        "Rules": {
-          "type": "array",
-          "insertionOrder": false,
-          "minItems": 1,
-          "maxItems": 25,
-          "items": {
-            "$ref": "#/definitions/Rule"
-          }
+        "AttributeMatchingModel": {
+          "type": "string",
+          "enum": [
+            "ONE_TO_ONE",
+            "MANY_TO_MANY"
+          ]
         },
         "RuleDefinitionType": {
           "type": "string",
@@ -125,12 +176,14 @@
             "TARGET"
           ]
         },
-        "AttributeMatchingModel": {
-          "type": "string",
-          "enum": [
-            "ONE_TO_ONE",
-            "MANY_TO_MANY"
-          ]
+        "Rules": {
+          "minItems": 1,
+          "maxItems": 25,
+          "insertionOrder": false,
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/Rule"
+          }
         },
         "RecordMatchingModel": {
           "type": "string",
@@ -143,217 +196,164 @@
       "required": [
         "AttributeMatchingModel",
         "RecordMatchingModel"
-      ],
-      "additionalProperties": false
+      ]
     },
-    "Rule": {
-      "type": "object",
-      "properties": {
-        "RuleName": {
-          "type": "string",
-          "pattern": "^[a-zA-Z_0-9- \\t]*$",
-          "minLength": 0,
-          "maxLength": 255
-        },
-        "MatchingKeys": {
-          "type": "array",
-          "insertionOrder": false,
-          "minItems": 1,
-          "maxItems": 15,
-          "items": {
-            "$ref": "#/definitions/AttributeName"
-          }
-        }
-      },
-      "required": [
-        "RuleName",
-        "MatchingKeys"
-      ],
-      "additionalProperties": false
+    "KMSArn": {
+      "pattern": "^arn:(aws|aws-us-gov|aws-cn):kms:.*:[0-9]+:.*$",
+      "type": "string"
     },
     "ProviderProperties": {
+      "additionalProperties": false,
       "type": "object",
       "properties": {
+        "IntermediateSourceConfiguration": {
+          "$ref": "#/definitions/IntermediateSourceConfiguration"
+        },
         "ProviderServiceArn": {
-          "type": "string",
+          "pattern": "^arn:(aws|aws-us-gov|aws-cn):(entityresolution):([a-z]{2}-[a-z]{1,10}-[0-9])::providerservice/([a-zA-Z0-9_-]{1,255})/([a-zA-Z0-9_-]{1,255})$",
           "description": "Arn of the Provider Service being used.",
-          "pattern": "^arn:(aws|aws-us-gov|aws-cn):entityresolution:([A-Za-z0-9]+(-[A-Za-z0-9]+)+)::providerservice/[A-Za-z0-9]+/[A-Za-z0-9]+$"
+          "type": "string"
         },
         "ProviderConfiguration": {
-          "type": "object",
-          "additionalProperties": false,
           "patternProperties": {
             "^.+$": {
               "type": "string"
             }
           },
-          "description": "Additional Provider configuration that would be required for the provider service. The Configuration must be in JSON string format"
-        },
-        "IntermediateSourceConfiguration": {
-          "$ref": "#/definitions/IntermediateSourceConfiguration"
+          "description": "Additional Provider configuration that would be required for the provider service. The Configuration must be in JSON string format",
+          "additionalProperties": false,
+          "type": "object"
         }
       },
       "required": [
         "ProviderServiceArn"
-      ],
-      "additionalProperties": false
+      ]
     },
     "IntermediateSourceConfiguration": {
+      "additionalProperties": false,
       "type": "object",
       "properties": {
         "IntermediateS3Path": {
-          "type": "string",
-          "description": "The s3 path that would be used to stage the intermediate data being generated during workflow execution."
+          "description": "The s3 path that would be used to stage the intermediate data being generated during workflow execution.",
+          "type": "string"
         }
       },
       "required": [
         "IntermediateS3Path"
-      ],
-      "additionalProperties": false
+      ]
+    },
+    "SchemaMappingArn": {
+      "pattern": "^arn:(aws|aws-us-gov|aws-cn):entityresolution:.*:[0-9]+:(schemamapping/.*)$",
+      "description": "The SchemaMapping arn associated with the Schema",
+      "type": "string"
+    },
+    "AttributeName": {
+      "minLength": 0,
+      "pattern": "^[a-zA-Z_0-9- \\t]*$",
+      "type": "string",
+      "maxLength": 255
+    },
+    "Rule": {
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+        "MatchingKeys": {
+          "minItems": 1,
+          "maxItems": 15,
+          "insertionOrder": false,
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/AttributeName"
+          }
+        },
+        "RuleName": {
+          "minLength": 0,
+          "pattern": "^[a-zA-Z_0-9- \\t]*$",
+          "type": "string",
+          "maxLength": 255
+        }
+      },
+      "required": [
+        "RuleName",
+        "MatchingKeys"
+      ]
     },
     "Tag": {
       "description": "A key-value pair to associate with a resource",
+      "additionalProperties": false,
       "type": "object",
       "properties": {
-        "Key": {
-          "type": "string",
-          "description": "The key name of the tag. You can specify a value that is 1 to 128 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -.",
-          "minLength": 1,
-          "maxLength": 128
-        },
         "Value": {
-          "type": "string",
-          "description": "The value for the tag. You can specify a value that is 0 to 256 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -.",
           "minLength": 0,
+          "description": "The value for the tag. You can specify a value that is 0 to 256 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -.",
+          "type": "string",
           "maxLength": 256
+        },
+        "Key": {
+          "minLength": 1,
+          "description": "The key name of the tag. You can specify a value that is 1 to 128 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -.",
+          "type": "string",
+          "maxLength": 128
         }
       },
       "required": [
         "Key",
         "Value"
-      ],
-      "additionalProperties": false
+      ]
     }
   },
   "properties": {
-    "WorkflowName": {
-      "description": "The name of the IdMappingWorkflow",
-      "$ref": "#/definitions/EntityName"
-    },
     "Description": {
       "description": "The description of the IdMappingWorkflow",
       "$ref": "#/definitions/Description"
     },
     "InputSourceConfig": {
-      "type": "array",
-      "insertionOrder": false,
       "minItems": 1,
       "maxItems": 20,
+      "insertionOrder": false,
+      "type": "array",
       "items": {
         "$ref": "#/definitions/IdMappingWorkflowInputSource"
       }
     },
+    "IdMappingTechniques": {
+      "$ref": "#/definitions/IdMappingTechniques"
+    },
+    "WorkflowName": {
+      "description": "The name of the IdMappingWorkflow",
+      "$ref": "#/definitions/EntityName"
+    },
+    "CreatedAt": {
+      "$ref": "#/definitions/CreatedAt"
+    },
     "OutputSourceConfig": {
-      "type": "array",
-      "insertionOrder": false,
       "minItems": 1,
       "maxItems": 1,
+      "insertionOrder": false,
+      "type": "array",
       "items": {
         "$ref": "#/definitions/IdMappingWorkflowOutputSource"
       }
     },
-    "IdMappingTechniques": {
-      "$ref": "#/definitions/IdMappingTechniques"
+    "WorkflowArn": {
+      "$ref": "#/definitions/IdMappingWorkflowArn"
+    },
+    "UpdatedAt": {
+      "$ref": "#/definitions/UpdatedAt"
     },
     "RoleArn": {
-      "type": "string",
-      "pattern": "^arn:(aws|aws-us-gov|aws-cn):iam::\\d{12}:role/?[a-zA-Z_0-9+=,.@\\-_/]+$"
+      "pattern": "^arn:(aws|aws-us-gov|aws-cn):iam::\\d{12}:role/?[a-zA-Z_0-9+=,.@\\-_/]+$",
+      "type": "string"
     },
     "Tags": {
-      "type": "array",
-      "uniqueItems": true,
-      "insertionOrder": false,
       "minItems": 0,
       "maxItems": 200,
+      "uniqueItems": true,
+      "insertionOrder": false,
+      "type": "array",
       "items": {
         "$ref": "#/definitions/Tag"
       }
-    },
-    "WorkflowArn": {
-      "$ref": "#/definitions/IdMappingWorkflowArn"
-    },
-    "CreatedAt": {
-      "$ref": "#/definitions/CreatedAt"
-    },
-    "UpdatedAt": {
-      "$ref": "#/definitions/UpdatedAt"
-    }
-  },
-  "createOnlyProperties": [
-    "/properties/WorkflowName"
-  ],
-  "readOnlyProperties": [
-    "/properties/WorkflowArn",
-    "/properties/UpdatedAt",
-    "/properties/CreatedAt"
-  ],
-  "primaryIdentifier": [
-    "/properties/WorkflowName"
-  ],
-  "tagging": {
-    "taggable": true,
-    "tagOnCreate": true,
-    "tagUpdatable": true,
-    "cloudFormationSystemTags": true,
-    "tagProperty": "/properties/Tags"
-  },
-  "handlers": {
-    "create": {
-      "permissions": [
-        "entityresolution:CreateIdMappingWorkflow",
-        "entityresolution:GetIdMappingWorkflow",
-        "entityresolution:TagResource",
-        "kms:CreateGrant",
-        "kms:DescribeKey",
-        "iam:PassRole"
-      ]
-    },
-    "update": {
-      "permissions": [
-        "entityresolution:GetIdMappingWorkflow",
-        "entityresolution:UpdateIdMappingWorkflow",
-        "entityresolution:ListTagsForResource",
-        "entityresolution:TagResource",
-        "entityresolution:UntagResource",
-        "iam:PassRole",
-        "kms:CreateGrant",
-        "kms:DescribeKey"
-      ]
-    },
-    "read": {
-      "permissions": [
-        "entityresolution:GetIdMappingWorkflow",
-        "entityresolution:ListTagsForResource"
-      ]
-    },
-    "delete": {
-      "permissions": [
-        "entityresolution:DeleteIdMappingWorkflow",
-        "entityresolution:GetIdMappingWorkflow",
-        "entityresolution:UntagResource"
-      ]
-    },
-    "list": {
-      "permissions": [
-        "entityresolution:ListIdMappingWorkflows"
-      ]
     }
-  },
-  "required": [
-    "WorkflowName",
-    "InputSourceConfig",
-    "IdMappingTechniques",
-    "RoleArn"
-  ],
-  "additionalProperties": false
+  }
 }
diff --git a/internal/aws/cfn/schemas/aws/fms/policy.json b/internal/aws/cfn/schemas/aws/fms/policy.json
index 14388509..9d2b4fad 100644
--- a/internal/aws/cfn/schemas/aws/fms/policy.json
+++ b/internal/aws/cfn/schemas/aws/fms/policy.json
@@ -259,7 +259,7 @@
       "description": "Firewall managed service data.",
       "type": "string",
       "minLength": 1,
-      "maxLength": 8192
+      "maxLength": 30000
     },
     "PolicyType": {
       "description": "Firewall policy type.",
diff --git a/internal/aws/cfn/schemas/aws/globalaccelerator/crossaccountattachment.json b/internal/aws/cfn/schemas/aws/globalaccelerator/crossaccountattachment.json
index 4592e4f1..e842a652 100644
--- a/internal/aws/cfn/schemas/aws/globalaccelerator/crossaccountattachment.json
+++ b/internal/aws/cfn/schemas/aws/globalaccelerator/crossaccountattachment.json
@@ -33,13 +33,13 @@
         "EndpointId": {
           "type": "string"
         },
+        "Cidr": {
+          "type": "string"
+        },
         "Region": {
           "type": "string"
         }
       },
-      "required": [
-        "EndpointId"
-      ],
       "additionalProperties": false
     }
   },
diff --git a/internal/aws/cfn/schemas/aws/kinesisfirehose/deliverystream.json b/internal/aws/cfn/schemas/aws/kinesisfirehose/deliverystream.json
index 635a7b14..8fe0a02b 100644
--- a/internal/aws/cfn/schemas/aws/kinesisfirehose/deliverystream.json
+++ b/internal/aws/cfn/schemas/aws/kinesisfirehose/deliverystream.json
@@ -56,6 +56,9 @@
     "SnowflakeDestinationConfiguration": {
       "$ref": "#/definitions/SnowflakeDestinationConfiguration"
     },
+    "IcebergDestinationConfiguration": {
+      "$ref": "#/definitions/IcebergDestinationConfiguration"
+    },
     "Tags": {
       "type": "array",
       "items": {
@@ -243,6 +246,9 @@
           "maxLength": 255,
           "pattern": "[a-zA-Z0-9\\._\\-]+"
         },
+        "ReadFromTimestamp": {
+          "type": "string"
+        },
         "AuthenticationConfiguration": {
           "$ref": "#/definitions/AuthenticationConfiguration"
         }
@@ -893,6 +899,9 @@
         },
         "SecretsManagerConfiguration": {
           "$ref": "#/definitions/SecretsManagerConfiguration"
+        },
+        "BufferingHints": {
+          "$ref": "#/definitions/SnowflakeBufferingHints"
         }
       },
       "required": [
@@ -904,6 +913,104 @@
         "S3Configuration"
       ]
     },
+    "IcebergDestinationConfiguration": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "DestinationTableConfigurationList": {
+          "$ref": "#/definitions/DestinationTableConfigurationList"
+        },
+        "ProcessingConfiguration": {
+          "$ref": "#/definitions/ProcessingConfiguration"
+        },
+        "CloudWatchLoggingOptions": {
+          "$ref": "#/definitions/CloudWatchLoggingOptions"
+        },
+        "CatalogConfiguration": {
+          "$ref": "#/definitions/CatalogConfiguration"
+        },
+        "RoleARN": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 512,
+          "pattern": "arn:.*",
+          "relationshipRef": {
+            "typeName": "AWS::IAM::Role",
+            "propertyPath": "/properties/Arn"
+          }
+        },
+        "RetryOptions": {
+          "$ref": "#/definitions/RetryOptions"
+        },
+        "s3BackupMode": {
+          "type": "string",
+          "enum": [
+            "AllData",
+            "FailedDataOnly"
+          ]
+        },
+        "BufferingHints": {
+          "$ref": "#/definitions/BufferingHints"
+        },
+        "S3Configuration": {
+          "$ref": "#/definitions/S3DestinationConfiguration"
+        }
+      },
+      "required": [
+        "RoleARN",
+        "CatalogConfiguration",
+        "S3Configuration"
+      ]
+    },
+    "CatalogConfiguration": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "CatalogArn": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 512,
+          "pattern": "arn:.*"
+        }
+      }
+    },
+    "DestinationTableConfiguration": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "DestinationTableName": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 512
+        },
+        "DestinationDatabaseName": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 512
+        },
+        "S3ErrorOutputPrefix": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 1024
+        },
+        "UniqueKeys": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/definitions/UniqueKey"
+          }
+        }
+      },
+      "required": [
+        "DestinationDatabaseName",
+        "DestinationTableName"
+      ]
+    },
+    "UniqueKey": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 512
+    },
     "BufferingHints": {
       "type": "object",
       "additionalProperties": false,
@@ -932,6 +1039,12 @@
         }
       }
     },
+    "DestinationTableConfigurationList": {
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/DestinationTableConfiguration"
+      }
+    },
     "SplunkRetryOptions": {
       "type": "object",
       "additionalProperties": false,
@@ -1112,6 +1225,18 @@
         }
       }
     },
+    "SnowflakeBufferingHints": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "IntervalInSeconds": {
+          "type": "integer"
+        },
+        "SizeInMBs": {
+          "type": "integer"
+        }
+      }
+    },
     "CloudWatchLoggingOptions": {
       "type": "object",
       "additionalProperties": false,
@@ -1598,6 +1723,7 @@
     "/properties/AmazonOpenSearchServerlessDestinationConfiguration/VpcConfiguration",
     "/properties/KinesisStreamSourceConfiguration",
     "/properties/MSKSourceConfiguration",
+    "/properties/IcebergDestinationConfiguration",
     "/properties/SnowflakeDestinationConfiguration/SnowflakeVpcConfiguration"
   ],
   "primaryIdentifier": [
diff --git a/internal/aws/cfn/schemas/aws/lightsail/alarm.json b/internal/aws/cfn/schemas/aws/lightsail/alarm.json
index 9b4d4f3c..ded3b858 100644
--- a/internal/aws/cfn/schemas/aws/lightsail/alarm.json
+++ b/internal/aws/cfn/schemas/aws/lightsail/alarm.json
@@ -9,7 +9,7 @@
       "pattern": "\\w[\\w\\-]*\\w"
     },
     "MonitoredResourceName": {
-      "description": "The validation status of the SSL/TLS certificate.",
+      "description": "The name of the Lightsail resource that the alarm monitors.",
       "type": "string"
     },
     "MetricName": {
diff --git a/internal/aws/cfn/schemas/aws/lightsail/certificate.json b/internal/aws/cfn/schemas/aws/lightsail/certificate.json
index 1673956d..3b7fa6ff 100644
--- a/internal/aws/cfn/schemas/aws/lightsail/certificate.json
+++ b/internal/aws/cfn/schemas/aws/lightsail/certificate.json
@@ -1,6 +1,6 @@
 {
   "typeName": "AWS::Lightsail::Certificate",
-  "description": "An example resource schema demonstrating some basic constructs and validation rules.",
+  "description": "Resource Type definition for AWS::Lightsail::Certificate.",
   "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-rpdk.git",
   "definitions": {
     "Tag": {
diff --git a/internal/aws/cfn/schemas/aws/mediaconnect/flowoutput.json b/internal/aws/cfn/schemas/aws/mediaconnect/flowoutput.json
index 8720d817..11a3edeb 100644
--- a/internal/aws/cfn/schemas/aws/mediaconnect/flowoutput.json
+++ b/internal/aws/cfn/schemas/aws/mediaconnect/flowoutput.json
@@ -230,6 +230,14 @@
       "items": {
         "$ref": "#/definitions/MediaStreamOutputConfiguration"
       }
+    },
+    "OutputStatus": {
+      "type": "string",
+      "enum": [
+        "ENABLED",
+        "DISABLED"
+      ],
+      "description": "An indication of whether the output should transmit data or not."
     }
   },
   "additionalProperties": false,
diff --git a/internal/aws/cfn/schemas/aws/mediapackagev2/channel.json b/internal/aws/cfn/schemas/aws/mediapackagev2/channel.json
index 3ba9ed82..0d4bc24e 100644
--- a/internal/aws/cfn/schemas/aws/mediapackagev2/channel.json
+++ b/internal/aws/cfn/schemas/aws/mediapackagev2/channel.json
@@ -17,6 +17,13 @@
       },
       "additionalProperties": false
     },
+    "InputType": {
+      "type": "string",
+      "enum": [
+        "HLS",
+        "CMAF"
+      ]
+    },
     "Tag": {
       "type": "object",
       "properties": {
@@ -65,6 +72,9 @@
       },
       "description": "<p>The list of ingest endpoints.</p>"
     },
+    "InputType": {
+      "$ref": "#/definitions/InputType"
+    },
     "ModifiedAt": {
       "type": "string",
       "description": "<p>The date and time the channel was modified.</p>",
@@ -93,7 +103,8 @@
   ],
   "createOnlyProperties": [
     "/properties/ChannelGroupName",
-    "/properties/ChannelName"
+    "/properties/ChannelName",
+    "/properties/InputType"
   ],
   "primaryIdentifier": [
     "/properties/Arn"
diff --git a/internal/aws/cfn/schemas/aws/mediapackagev2/originendpoint.json b/internal/aws/cfn/schemas/aws/mediapackagev2/originendpoint.json
index 14b7eba8..860078f6 100644
--- a/internal/aws/cfn/schemas/aws/mediapackagev2/originendpoint.json
+++ b/internal/aws/cfn/schemas/aws/mediapackagev2/originendpoint.json
@@ -146,6 +146,15 @@
       },
       "additionalProperties": false
     },
+    "EndpointErrorCondition": {
+      "type": "string",
+      "enum": [
+        "STALE_MANIFEST",
+        "INCOMPLETE_MANIFEST",
+        "MISSING_DRM_KEY",
+        "SLATE_INPUT"
+      ]
+    },
     "FilterConfiguration": {
       "type": "object",
       "description": "<p>Filter configuration includes settings for manifest filtering, start and end times, and time delay that apply to all of your egress requests for this manifest. </p>",
@@ -175,6 +184,20 @@
       },
       "additionalProperties": false
     },
+    "ForceEndpointErrorConfiguration": {
+      "type": "object",
+      "description": "<p>The failover settings for the endpoint.</p>",
+      "properties": {
+        "EndpointErrorConditions": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/EndpointErrorCondition"
+          },
+          "description": "<p>The failover settings for the endpoint. The options are:</p>\n         <ul>\n            <li>\n               <p>\n                  <code>STALE_MANIFEST</code> - The manifest stalled and there a no new segments or parts.</p>\n            </li>\n            <li>\n               <p>\n                  <code>INCOMPLETE_MANIFEST</code> - There is a gap in the manifest.</p>\n            </li>\n            <li>\n               <p>\n                  <code>MISSING_DRM_KEY</code> - Key rotation is enabled but we're unable to fetch the key for the current key period.</p>\n            </li>\n         </ul>"
+        }
+      },
+      "additionalProperties": false
+    },
     "DashManifestConfiguration": {
       "type": "object",
       "description": "<p>Retrieve the DASH manifest configuration.</p>",
@@ -532,6 +555,9 @@
       "minLength": 0,
       "description": "<p>Enter any descriptive text that helps you to identify the origin endpoint.</p>"
     },
+    "ForceEndpointErrorConfiguration": {
+      "$ref": "#/definitions/ForceEndpointErrorConfiguration"
+    },
     "HlsManifests": {
       "type": "array",
       "items": {
diff --git a/internal/aws/cfn/schemas/aws/neptune/dbcluster.json b/internal/aws/cfn/schemas/aws/neptune/dbcluster.json
index 492b7521..6d7b27c8 100644
--- a/internal/aws/cfn/schemas/aws/neptune/dbcluster.json
+++ b/internal/aws/cfn/schemas/aws/neptune/dbcluster.json
@@ -275,7 +275,8 @@
         "rds:ModifyDBCluster",
         "rds:RestoreDBClusterFromSnapshot",
         "rds:RestoreDBClusterToPointInTime",
-        "kms:*"
+        "kms:CreateGrant",
+        "kms:DescribeKey"
       ],
       "timeoutInMinutes": 2160
     },
@@ -283,7 +284,8 @@
       "permissions": [
         "rds:DescribeDBClusters",
         "rds:ListTagsForResource",
-        "kms:*"
+        "kms:CreateGrant",
+        "kms:DescribeKey"
       ],
       "timeoutInMinutes": 2160
     },
@@ -303,7 +305,8 @@
         "rds:RemoveFromGlobalCluster",
         "rds:RemoveRoleFromDBCluster",
         "rds:RemoveTagsFromResource",
-        "kms:*"
+        "kms:CreateGrant",
+        "kms:DescribeKey"
       ],
       "timeoutInMinutes": 2160
     },
@@ -316,7 +319,8 @@
         "rds:ListTagsForResource",
         "rds:RemoveFromGlobalCluster",
         "rds:CreateDBClusterSnapshot",
-        "kms:*"
+        "kms:CreateGrant",
+        "kms:DescribeKey"
       ],
       "timeoutInMinutes": 2160
     },
@@ -324,7 +328,8 @@
       "permissions": [
         "rds:DescribeDBClusters",
         "rds:ListTagsForResource",
-        "kms:*"
+        "kms:CreateGrant",
+        "kms:DescribeKey"
       ],
       "timeoutInMinutes": 2160
     }
diff --git a/internal/aws/cfn/schemas/aws/organizations/organization.json b/internal/aws/cfn/schemas/aws/organizations/organization.json
index 7e87bb25..5f8abd6f 100644
--- a/internal/aws/cfn/schemas/aws/organizations/organization.json
+++ b/internal/aws/cfn/schemas/aws/organizations/organization.json
@@ -76,7 +76,9 @@
       ]
     },
     "update": {
-      "permissions": []
+      "permissions": [
+        "organizations:DescribeOrganization"
+      ]
     }
   },
   "readOnlyProperties": [
diff --git a/internal/aws/cfn/schemas/aws/rds/dbcluster.json b/internal/aws/cfn/schemas/aws/rds/dbcluster.json
index f5fb1562..2c23f419 100644
--- a/internal/aws/cfn/schemas/aws/rds/dbcluster.json
+++ b/internal/aws/cfn/schemas/aws/rds/dbcluster.json
@@ -213,7 +213,7 @@
       "type": "string"
     },
     "PubliclyAccessible": {
-      "description": "Specifies whether the DB cluster is publicly accessible.\n When the DB cluster is publicly accessible, its Domain Name System (DNS) endpoint resolves to the private IP address from within the DB cluster's virtual private cloud (VPC). It resolves to the public IP address from outside of the DB cluster's VPC. Access to the DB cluster is ultimately controlled by the security group it uses. That public access isn't permitted if the security group assigned to the DB cluster doesn't permit it.\n When the DB cluster isn't publicly accessible, it is an internal DB cluster with a DNS name that resolves to a private IP address.\n Valid for Cluster Type: Multi-AZ DB clusters only\n Default: The default behavior varies depending on whether ``DBSubnetGroupName`` is specified.\n If ``DBSubnetGroupName`` isn't specified, and ``PubliclyAccessible`` isn't specified, the following applies:\n  +  If the default VPC in the target Region doesn?t have an internet gateway attached to it, the DB cluster is private.\n  +  If the default VPC in the target Region has an internet gateway attached to it, the DB cluster is public.\n  \n If ``DBSubnetGroupName`` is specified, and ``PubliclyAccessible`` isn't specified, the following applies:\n  +  If the subnets are part of a VPC that doesn?t have an internet gateway attached to it, the DB cluster is private.\n  +  If the subnets are part of a VPC that has an internet gateway attached to it, the DB cluster is public.",
+      "description": "Specifies whether the DB cluster is publicly accessible.\n When the DB cluster is publicly accessible and you connect from outside of the DB cluster's virtual private cloud (VPC), its Domain Name System (DNS) endpoint resolves to the public IP address. When you connect from within the same VPC as the DB cluster, the endpoint resolves to the private IP address. Access to the DB cluster is ultimately controlled by the security group it uses. That public access isn't permitted if the security group assigned to the DB cluster doesn't permit it.\n When the DB cluster isn't publicly accessible, it is an internal DB cluster with a DNS name that resolves to a private IP address.\n Valid for Cluster Type: Multi-AZ DB clusters only\n Default: The default behavior varies depending on whether ``DBSubnetGroupName`` is specified.\n If ``DBSubnetGroupName`` isn't specified, and ``PubliclyAccessible`` isn't specified, the following applies:\n  +  If the default VPC in the target Region doesn?t have an internet gateway attached to it, the DB cluster is private.\n  +  If the default VPC in the target Region has an internet gateway attached to it, the DB cluster is public.\n  \n If ``DBSubnetGroupName`` is specified, and ``PubliclyAccessible`` isn't specified, the following applies:\n  +  If the subnets are part of a VPC that doesn?t have an internet gateway attached to it, the DB cluster is private.\n  +  If the subnets are part of a VPC that has an internet gateway attached to it, the DB cluster is public.",
       "type": "boolean"
     },
     "ReplicationSourceIdentifier": {
@@ -403,7 +403,7 @@
       "properties": {
         "SecretArn": {
           "type": "string",
-          "description": "The Amazon Resource Name (ARN) of the secret."
+          "description": "The Amazon Resource Name (ARN) of the secret. This parameter is a return value that you can retrieve using the ``Fn::GetAtt`` intrinsic function. For more information, see [Return values](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-rds-dbcluster.html#aws-resource-rds-dbcluster-return-values)."
         },
         "KmsKeyId": {
           "type": "string",
@@ -436,7 +436,6 @@
     "/properties/Endpoint",
     "/properties/Endpoint/Address",
     "/properties/Endpoint/Port",
-    "/properties/ReadEndpoint/Port",
     "/properties/ReadEndpoint/Address",
     "/properties/MasterUserSecret/SecretArn",
     "/properties/StorageThroughput"
@@ -527,6 +526,7 @@
     },
     "delete": {
       "permissions": [
+        "rds:AddTagsToResource",
         "rds:CreateDBClusterSnapshot",
         "rds:DeleteDBCluster",
         "rds:DeleteDBInstance",
@@ -540,5 +540,16 @@
         "rds:DescribeDBClusters"
       ]
     }
+  },
+  "tagging": {
+    "taggable": true,
+    "tagOnCreate": true,
+    "tagUpdatable": true,
+    "cloudFormationSystemTags": true,
+    "tagProperty": "/properties/Tags",
+    "permissions": [
+      "rds:AddTagsToResource",
+      "rds:RemoveTagsFromResource"
+    ]
   }
 }
diff --git a/internal/aws/cfn/schemas/aws/rds/dbinstance.json b/internal/aws/cfn/schemas/aws/rds/dbinstance.json
index 475734c2..4660d185 100644
--- a/internal/aws/cfn/schemas/aws/rds/dbinstance.json
+++ b/internal/aws/cfn/schemas/aws/rds/dbinstance.json
@@ -74,7 +74,7 @@
           "description": "The value of a processor feature."
         }
       },
-      "description": "The ``ProcessorFeature`` property type specifies the processor features of a DB instance class status."
+      "description": "The ``ProcessorFeature`` property type specifies the processor features of a DB instance class."
     },
     "Tag": {
       "description": "Metadata assigned to an Amazon RDS resource consisting of a key-value pair.\n For more information, see [Tagging Amazon RDS Resources](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Tagging.html) in the *Amazon RDS User Guide* or [Tagging Amazon Aurora and Amazon RDS Resources](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_Tagging.html) in the *Amazon Aurora User Guide*.",
@@ -104,7 +104,7 @@
       "properties": {
         "SecretArn": {
           "type": "string",
-          "description": "The Amazon Resource Name (ARN) of the secret."
+          "description": "The Amazon Resource Name (ARN) of the secret. This parameter is a return value that you can retrieve using the ``Fn::GetAtt`` intrinsic function. For more information, see [Return values](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-rds-dbinstance.html#aws-resource-rds-dbinstance-return-values)."
         },
         "KmsKeyId": {
           "type": "string",
@@ -137,7 +137,7 @@
     },
     "AutomaticBackupReplicationRegion": {
       "type": "string",
-      "description": "The destination region for the backup replication of the DB instance. For more info, see [Replicating automated backups to another Region](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ReplicateBackups.html) in the *Amazon RDS User Guide*."
+      "description": ""
     },
     "AutomaticBackupReplicationKmsKeyId": {
       "type": "string",
@@ -222,7 +222,7 @@
     },
     "DBSnapshotIdentifier": {
       "type": "string",
-      "description": "The name or Amazon Resource Name (ARN) of the DB snapshot that's used to restore the DB instance. If you're restoring from a shared manual DB snapshot, you must specify the ARN of the snapshot.\n By specifying this property, you can create a DB instance from the specified DB snapshot. If the ``DBSnapshotIdentifier`` property is an empty string or the ``AWS::RDS::DBInstance`` declaration has no ``DBSnapshotIdentifier`` property, AWS CloudFormation creates a new database. If the property contains a value (other than an empty string), AWS CloudFormation creates a database from the specified snapshot. If a snapshot with the specified name doesn't exist, AWS CloudFormation can't create the database and it rolls back the stack.\n Some DB instance properties aren't valid when you restore from a snapshot, such as the ``MasterUsername`` and ``MasterUserPassword`` properties. For information about the properties that you can specify, see the ``RestoreDBInstanceFromDBSnapshot`` action in the *Amazon RDS API Reference*.\n After you restore a DB instance with a ``DBSnapshotIdentifier`` property, you must specify the same ``DBSnapshotIdentifier`` property for any future updates to the DB instance. When you specify this property for an update, the DB instance is not restored from the DB snapshot again, and the data in the database is not changed. However, if you don't specify the ``DBSnapshotIdentifier`` property, an empty DB instance is created, and the original DB instance is deleted. If you specify a property that is different from the previous snapshot restore property, a new DB instance is restored from the specified ``DBSnapshotIdentifier`` property, and the original DB instance is deleted.\n If you specify the ``DBSnapshotIdentifier`` property to restore a DB instance (as opposed to specifying it for DB instance updates), then don't specify the following properties:\n  +   ``CharacterSetName`` \n  +   ``DBClusterIdentifier`` \n  +   ``DBName`` \n  +   ``DeleteAutomatedBackups`` \n  +   ``EnablePerformanceInsights`` \n  +   ``KmsKeyId`` \n  +   ``MasterUsername`` \n  +   ``MasterUserPassword`` \n  +   ``PerformanceInsightsKMSKeyId`` \n  +   ``PerformanceInsightsRetentionPeriod`` \n  +   ``PromotionTier`` \n  +   ``SourceDBInstanceIdentifier`` \n  +   ``SourceRegion`` \n  +   ``StorageEncrypted`` (for an encrypted snapshot)\n  +   ``Timezone`` \n  \n  *Amazon Aurora* \n Not applicable. Snapshot restore is managed by the DB cluster."
+      "description": "The name or Amazon Resource Name (ARN) of the DB snapshot that's used to restore the DB instance. If you're restoring from a shared manual DB snapshot, you must specify the ARN of the snapshot.\n By specifying this property, you can create a DB instance from the specified DB snapshot. If the ``DBSnapshotIdentifier`` property is an empty string or the ``AWS::RDS::DBInstance`` declaration has no ``DBSnapshotIdentifier`` property, AWS CloudFormation creates a new database. If the property contains a value (other than an empty string), AWS CloudFormation creates a database from the specified snapshot. If a snapshot with the specified name doesn't exist, AWS CloudFormation can't create the database and it rolls back the stack.\n Some DB instance properties aren't valid when you restore from a snapshot, such as the ``MasterUsername`` and ``MasterUserPassword`` properties. For information about the properties that you can specify, see the ``RestoreDBInstanceFromDBSnapshot`` action in the *Amazon RDS API Reference*.\n After you restore a DB instance with a ``DBSnapshotIdentifier`` property, you must specify the same ``DBSnapshotIdentifier`` property for any future updates to the DB instance. When you specify this property for an update, the DB instance is not restored from the DB snapshot again, and the data in the database is not changed. However, if you don't specify the ``DBSnapshotIdentifier`` property, an empty DB instance is created, and the original DB instance is deleted. If you specify a property that is different from the previous snapshot restore property, a new DB instance is restored from the specified ``DBSnapshotIdentifier`` property, and the original DB instance is deleted.\n If you specify the ``DBSnapshotIdentifier`` property to restore a DB instance (as opposed to specifying it for DB instance updates), then don't specify the following properties:\n  +   ``CharacterSetName`` \n  +   ``DBClusterIdentifier`` \n  +   ``DBName`` \n  +   ``DeleteAutomatedBackups`` \n  +   ``KmsKeyId`` \n  +   ``MasterUsername`` \n  +   ``MasterUserPassword`` \n  +   ``PerformanceInsightsKMSKeyId`` \n  +   ``PerformanceInsightsRetentionPeriod`` \n  +   ``PromotionTier`` \n  +   ``SourceDBInstanceIdentifier`` \n  +   ``SourceRegion`` \n  +   ``StorageEncrypted`` (for an encrypted snapshot)\n  +   ``Timezone`` \n  \n  *Amazon Aurora* \n Not applicable. Snapshot restore is managed by the DB cluster."
     },
     "DBSubnetGroupName": {
       "type": "string",
@@ -653,6 +653,7 @@
     },
     "delete": {
       "permissions": [
+        "rds:AddTagsToResource",
         "rds:CreateDBSnapshot",
         "rds:DeleteDBInstance",
         "rds:DescribeDBInstances"
diff --git a/internal/aws/cfn/schemas/aws/rds/integration.json b/internal/aws/cfn/schemas/aws/rds/integration.json
index 121a90a5..4459b16f 100644
--- a/internal/aws/cfn/schemas/aws/rds/integration.json
+++ b/internal/aws/cfn/schemas/aws/rds/integration.json
@@ -1,6 +1,6 @@
 {
   "typeName": "AWS::RDS::Integration",
-  "description": "Creates a zero-ETL integration with Amazon Redshift.",
+  "description": "A zero-ETL integration with Amazon Redshift.",
   "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-rpdk.git",
   "properties": {
     "IntegrationName": {
@@ -11,7 +11,7 @@
     },
     "Description": {
       "type": "string",
-      "description": "The description of the integration.",
+      "description": "A description of the integration.",
       "minLength": 1,
       "maxLength": 1000
     },
@@ -20,21 +20,21 @@
       "maxItems": 50,
       "uniqueItems": true,
       "insertionOrder": false,
-      "description": "An array of key-value pairs to apply to this resource.",
+      "description": "A list of tags. For more information, see [Tagging Amazon RDS Resources](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Tagging.html) in the *Amazon RDS User Guide.*.",
       "items": {
         "$ref": "#/definitions/Tag"
       }
     },
     "DataFilter": {
       "type": "string",
-      "description": "The data filter for the integration.",
+      "description": "Data filters for the integration. These filters determine which tables from the source database are sent to the target Amazon Redshift data warehouse.",
       "minLength": 1,
       "maxLength": 25600,
       "pattern": "[a-zA-Z0-9_ \"\\\\\\-$,*.:?+\\/]*"
     },
     "SourceArn": {
       "type": "string",
-      "description": "The Amazon Resource Name (ARN) of the Aurora DB cluster to use as the source for replication."
+      "description": "The Amazon Resource Name (ARN) of the database to use as the source for replication."
     },
     "TargetArn": {
       "type": "string",
@@ -42,17 +42,19 @@
     },
     "IntegrationArn": {
       "type": "string",
-      "description": "The ARN of the integration."
+      "description": ""
     },
     "KMSKeyId": {
       "type": "string",
-      "description": "An optional AWS Key Management System (AWS KMS) key ARN for the key used to to encrypt the integration. The resource accepts the key ID and the key ARN forms. The key ID form can be used if the KMS key is owned by te same account. If the KMS key belongs to a different account than the calling account, the full key ARN must be specified. Do not use the key alias or the key alias ARN as this will cause a false drift of the resource."
+      "description": "The AWS Key Management System (AWS KMS) key identifier for the key to use to encrypt the integration. If you don't specify an encryption key, RDS uses a default AWS owned key."
     },
     "AdditionalEncryptionContext": {
-      "$ref": "#/definitions/EncryptionContextMap"
+      "$ref": "#/definitions/EncryptionContextMap",
+      "description": "An optional set of non-secret key?value pairs that contains additional contextual information about the data. For more information, see [Encryption context](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#encrypt_context) in the *Key Management Service Developer Guide*.\n You can only include this parameter if you specify the ``KMSKeyId`` parameter."
     },
     "CreateTime": {
-      "type": "string"
+      "type": "string",
+      "description": ""
     }
   },
   "required": [
@@ -71,19 +73,19 @@
       }
     },
     "Tag": {
-      "description": "A key-value pair to associate with a resource.",
+      "description": "Metadata assigned to an Amazon RDS resource consisting of a key-value pair.\n For more information, see [Tagging Amazon RDS Resources](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Tagging.html) in the *Amazon RDS User Guide* or [Tagging Amazon Aurora and Amazon RDS Resources](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_Tagging.html) in the *Amazon Aurora User Guide*.",
       "type": "object",
       "additionalProperties": false,
       "properties": {
         "Key": {
           "type": "string",
-          "description": "The key name of the tag. You can specify a value that is 1 to 128 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -. ",
+          "description": "A key is the required name of the tag. The string value can be from 1 to 128 Unicode characters in length and can't be prefixed with ``aws:`` or ``rds:``. The string can only contain only the set of Unicode letters, digits, white-space, '_', '.', ':', '/', '=', '+', '-', '@' (Java regex: \"^([\\\\p{L}\\\\p{Z}\\\\p{N}_.:/=+\\\\-@]*)$\").",
           "minLength": 1,
           "maxLength": 128
         },
         "Value": {
           "type": "string",
-          "description": "The value for the tag. You can specify a value that is 0 to 256 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -. ",
+          "description": "A value is the optional value of the tag. The string value can be from 1 to 256 Unicode characters in length and can't be prefixed with ``aws:`` or ``rds:``. The string can only contain only the set of Unicode letters, digits, white-space, '_', '.', ':', '/', '=', '+', '-', '@' (Java regex: \"^([\\\\p{L}\\\\p{Z}\\\\p{N}_.:/=+\\\\-@]*)$\").",
           "minLength": 0,
           "maxLength": 256
         }
@@ -101,7 +103,7 @@
           "minLength": 0
         }
       },
-      "description": "An optional set of non-secret key–value pairs that contains additional contextual information about the data.",
+      "description": "An optional set of non-secret key?value pairs that contains additional contextual information about the data.",
       "additionalProperties": false
     }
   },
@@ -162,7 +164,11 @@
     "taggable": true,
     "tagOnCreate": true,
     "tagUpdatable": true,
-    "tagProperty": "/properties/Tags"
+    "tagProperty": "/properties/Tags",
+    "permissions": [
+      "rds:AddTagsToResource",
+      "rds:RemoveTagsFromResource"
+    ]
   },
   "additionalProperties": false
 }
diff --git a/internal/aws/cfn/schemas/aws/s3outposts/bucket.json b/internal/aws/cfn/schemas/aws/s3outposts/bucket.json
index 9ae3477b..cb1f6f64 100644
--- a/internal/aws/cfn/schemas/aws/s3outposts/bucket.json
+++ b/internal/aws/cfn/schemas/aws/s3outposts/bucket.json
@@ -245,7 +245,12 @@
     "tagOnCreate": true,
     "tagUpdatable": true,
     "cloudFormationSystemTags": true,
-    "tagProperty": "/properties/Tags"
+    "tagProperty": "/properties/Tags",
+    "permissions": [
+      "s3-outposts:DeleteBucketTagging",
+      "s3-outposts:PutBucketTagging",
+      "s3-outposts:GetBucketTagging"
+    ]
   },
   "additionalProperties": false,
   "createOnlyProperties": [
diff --git a/internal/aws/cfn/schemas/aws/sagemaker/app.json b/internal/aws/cfn/schemas/aws/sagemaker/app.json
index 3db2ffe5..f541cb82 100644
--- a/internal/aws/cfn/schemas/aws/sagemaker/app.json
+++ b/internal/aws/cfn/schemas/aws/sagemaker/app.json
@@ -143,6 +143,12 @@
           "minLength": 1,
           "maxLength": 256,
           "pattern": "^arn:aws(-[\\w]+)*:sagemaker:.+:[0-9]{12}:image-version/[a-z0-9]([-.]?[a-z0-9])*/[0-9]+$"
+        },
+        "LifecycleConfigArn": {
+          "type": "string",
+          "description": "The Amazon Resource Name (ARN) of the Lifecycle Configuration to attach to the Resource.",
+          "maxLength": 256,
+          "pattern": "arn:aws[a-z\\-]*:sagemaker:[a-z0-9\\-]*:[0-9]{12}:studio-lifecycle-config/.*"
         }
       }
     },
diff --git a/internal/aws/cfn/schemas/aws/sagemaker/domain.json b/internal/aws/cfn/schemas/aws/sagemaker/domain.json
index 377463a5..a09f9143 100644
--- a/internal/aws/cfn/schemas/aws/sagemaker/domain.json
+++ b/internal/aws/cfn/schemas/aws/sagemaker/domain.json
@@ -271,6 +271,16 @@
       "properties": {
         "DefaultResourceSpec": {
           "$ref": "#/definitions/ResourceSpec"
+        },
+        "LifecycleConfigArns": {
+          "type": "array",
+          "description": "A list of LifecycleConfigArns available for use with JupyterServer apps.",
+          "uniqueItems": false,
+          "minItems": 0,
+          "maxItems": 30,
+          "items": {
+            "$ref": "#/definitions/StudioLifecycleConfigArn"
+          }
         }
       }
     },
@@ -386,6 +396,16 @@
         "DefaultResourceSpec": {
           "$ref": "#/definitions/ResourceSpec",
           "description": "The default instance type and the Amazon Resource Name (ARN) of the default SageMaker image used by the KernelGateway app."
+        },
+        "LifecycleConfigArns": {
+          "type": "array",
+          "description": "A list of LifecycleConfigArns available for use with KernelGateway apps.",
+          "uniqueItems": false,
+          "minItems": 0,
+          "maxItems": 30,
+          "items": {
+            "$ref": "#/definitions/StudioLifecycleConfigArn"
+          }
         }
       }
     },
diff --git a/internal/aws/cfn/schemas/aws/sagemaker/mlflowtrackingserver.json b/internal/aws/cfn/schemas/aws/sagemaker/mlflowtrackingserver.json
new file mode 100644
index 00000000..1d41f15f
--- /dev/null
+++ b/internal/aws/cfn/schemas/aws/sagemaker/mlflowtrackingserver.json
@@ -0,0 +1,165 @@
+{
+  "typeName": "AWS::SageMaker::MlflowTrackingServer",
+  "description": "Resource Type definition for AWS::SageMaker::MlflowTrackingServer",
+  "additionalProperties": false,
+  "properties": {
+    "TrackingServerName": {
+      "type": "string",
+      "description": "The name of the MLFlow Tracking Server.",
+      "minLength": 1,
+      "maxLength": 256,
+      "pattern": "^[a-zA-Z0-9](-*[a-zA-Z0-9]){0,255}$"
+    },
+    "TrackingServerArn": {
+      "description": "The Amazon Resource Name (ARN) of the MLFlow Tracking Server.",
+      "type": "string",
+      "maxLength": 2048,
+      "pattern": "^arn:aws[a-z\\-]*:sagemaker:[a-z0-9\\-]*:[0-9]{12}:mlflow-tracking-server/.*$"
+    },
+    "TrackingServerSize": {
+      "type": "string",
+      "description": "The size of the MLFlow Tracking Server.",
+      "enum": [
+        "Small",
+        "Medium",
+        "Large"
+      ]
+    },
+    "MlflowVersion": {
+      "type": "string",
+      "description": "The MLFlow Version used on the MLFlow Tracking Server.",
+      "minLength": 1,
+      "maxLength": 32,
+      "pattern": "^\\d+(\\.\\d+)+$"
+    },
+    "RoleArn": {
+      "type": "string",
+      "description": "The Amazon Resource Name (ARN) of an IAM role that enables Amazon SageMaker to perform tasks on behalf of the customer.",
+      "minLength": 20,
+      "maxLength": 2048,
+      "pattern": "^arn:aws[a-z\\-]*:iam::\\d{12}:role\\/?[a-zA-Z_0-9+=,.@\\-_\\/]+$"
+    },
+    "ArtifactStoreUri": {
+      "type": "string",
+      "description": "The Amazon S3 URI for MLFlow Tracking Server artifacts.",
+      "minLength": 1,
+      "maxLength": 2048,
+      "pattern": "^s3:\\/\\/([^\\/]+)\\/?(.*)$"
+    },
+    "AutomaticModelRegistration": {
+      "type": "boolean",
+      "description": "A flag to enable Automatic SageMaker Model Registration."
+    },
+    "WeeklyMaintenanceWindowStart": {
+      "type": "string",
+      "description": "The start of the time window for maintenance of the MLFlow Tracking Server in UTC time.",
+      "pattern": "^(Mon|Tue|Wed|Thu|Fri|Sat|Sun):([01]\\d|2[0-3]):([0-5]\\d)$",
+      "maxLength": 9
+    },
+    "Tags": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 50,
+      "description": "An array of key-value pairs to apply to this resource.",
+      "insertionOrder": false,
+      "items": {
+        "$ref": "#/definitions/Tag"
+      }
+    }
+  },
+  "definitions": {
+    "Tag": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "A key-value pair to associate with a resource.",
+      "properties": {
+        "Value": {
+          "type": "string",
+          "description": "The value for the tag. You can specify a value that is 1 to 255 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -. ",
+          "maxLength": 256
+        },
+        "Key": {
+          "type": "string",
+          "description": "The key name of the tag. You can specify a value that is 1 to 127 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -. ",
+          "minLength": 1,
+          "maxLength": 128
+        }
+      },
+      "required": [
+        "Value",
+        "Key"
+      ]
+    }
+  },
+  "required": [
+    "TrackingServerName",
+    "ArtifactStoreUri",
+    "RoleArn"
+  ],
+  "conditionalCreateOnlyProperties": [
+    "/properties/MlflowVersion",
+    "/properties/RoleArn"
+  ],
+  "createOnlyProperties": [
+    "/properties/TrackingServerName"
+  ],
+  "primaryIdentifier": [
+    "/properties/TrackingServerName"
+  ],
+  "readOnlyProperties": [
+    "/properties/TrackingServerArn"
+  ],
+  "tagging": {
+    "taggable": true,
+    "tagOnCreate": true,
+    "tagUpdatable": true,
+    "cloudFormationSystemTags": false,
+    "tagProperty": "/properties/Tags",
+    "permissions": [
+      "sagemaker:AddTags",
+      "sagemaker:ListTags",
+      "sagemaker:DeleteTags"
+    ]
+  },
+  "handlers": {
+    "create": {
+      "permissions": [
+        "sagemaker:CreateMlflowTrackingServer",
+        "sagemaker:DescribeMlflowTrackingServer",
+        "sagemaker:AddTags",
+        "sagemaker:ListTags",
+        "iam:PassRole"
+      ],
+      "timeoutInMinutes": 65
+    },
+    "read": {
+      "permissions": [
+        "sagemaker:DescribeMlflowTrackingServer",
+        "sagemaker:ListTags"
+      ]
+    },
+    "update": {
+      "permissions": [
+        "sagemaker:UpdateMlflowTrackingServer",
+        "sagemaker:DescribeMlflowTrackingServer",
+        "sagemaker:ListTags",
+        "sagemaker:AddTags",
+        "sagemaker:DeleteTags",
+        "iam:PassRole"
+      ],
+      "timeoutInMinutes": 65
+    },
+    "delete": {
+      "permissions": [
+        "sagemaker:DeleteMlflowTrackingServer",
+        "sagemaker:DescribeMlflowTrackingServer"
+      ],
+      "timeoutInMinutes": 65
+    },
+    "list": {
+      "permissions": [
+        "sagemaker:ListMlflowTrackingServers"
+      ]
+    }
+  }
+}
diff --git a/internal/aws/cfn/schemas/aws/sagemaker/model.json b/internal/aws/cfn/schemas/aws/sagemaker/model.json
index 4fd3bbe0..3273504a 100644
--- a/internal/aws/cfn/schemas/aws/sagemaker/model.json
+++ b/internal/aws/cfn/schemas/aws/sagemaker/model.json
@@ -116,6 +116,9 @@
         "CompressionType": {
           "type": "string"
         },
+        "HubAccessConfig": {
+          "$ref": "#/definitions/HubAccessConfig"
+        },
         "S3Uri": {
           "type": "string"
         }
@@ -202,6 +205,18 @@
         "S3DataSource"
       ]
     },
+    "HubAccessConfig": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "HubContentArn": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "HubContentArn"
+      ]
+    },
     "MultiModelConfig": {
       "type": "object",
       "additionalProperties": false,
diff --git a/internal/aws/cfn/schemas/aws/sagemaker/space.json b/internal/aws/cfn/schemas/aws/sagemaker/space.json
index dea37f8b..a8513137 100644
--- a/internal/aws/cfn/schemas/aws/sagemaker/space.json
+++ b/internal/aws/cfn/schemas/aws/sagemaker/space.json
@@ -215,6 +215,16 @@
       "properties": {
         "DefaultResourceSpec": {
           "$ref": "#/definitions/ResourceSpec"
+        },
+        "LifecycleConfigArns": {
+          "type": "array",
+          "description": "A list of LifecycleConfigArns available for use with JupyterServer apps.",
+          "uniqueItems": false,
+          "minItems": 0,
+          "maxItems": 30,
+          "items": {
+            "$ref": "#/definitions/StudioLifecycleConfigArn"
+          }
         }
       }
     },
@@ -330,6 +340,12 @@
           "description": "The ARN of the image version created on the instance.",
           "maxLength": 256,
           "pattern": "^arn:aws(-[\\w]+)*:sagemaker:.+:[0-9]{12}:image-version/[a-z0-9]([-.]?[a-z0-9])*/[0-9]+$"
+        },
+        "LifecycleConfigArn": {
+          "type": "string",
+          "description": "The Amazon Resource Name (ARN) of the Lifecycle Configuration to attach to the Resource.",
+          "maxLength": 256,
+          "pattern": "arn:aws[a-z\\-]*:sagemaker:[a-z0-9\\-]*:[0-9]{12}:studio-lifecycle-config/.*"
         }
       }
     },
@@ -351,9 +367,25 @@
         "DefaultResourceSpec": {
           "$ref": "#/definitions/ResourceSpec",
           "description": "The default instance type and the Amazon Resource Name (ARN) of the default SageMaker image used by the KernelGateway app."
+        },
+        "LifecycleConfigArns": {
+          "type": "array",
+          "description": "A list of LifecycleConfigArns available for use with KernelGateway apps.",
+          "uniqueItems": false,
+          "minItems": 0,
+          "maxItems": 30,
+          "items": {
+            "$ref": "#/definitions/StudioLifecycleConfigArn"
+          }
         }
       }
     },
+    "StudioLifecycleConfigArn": {
+      "type": "string",
+      "description": "The Amazon Resource Name (ARN) of the Lifecycle Configuration to attach to the Resource.",
+      "maxLength": 256,
+      "pattern": "arn:aws[a-z\\-]*:sagemaker:[a-z0-9\\-]*:[0-9]{12}:studio-lifecycle-config/.*"
+    },
     "CustomImage": {
       "type": "object",
       "description": "A custom SageMaker image.",
diff --git a/internal/aws/cfn/schemas/aws/sagemaker/userprofile.json b/internal/aws/cfn/schemas/aws/sagemaker/userprofile.json
index 6d21d82f..87dbf189 100644
--- a/internal/aws/cfn/schemas/aws/sagemaker/userprofile.json
+++ b/internal/aws/cfn/schemas/aws/sagemaker/userprofile.json
@@ -136,6 +136,16 @@
       "properties": {
         "DefaultResourceSpec": {
           "$ref": "#/definitions/ResourceSpec"
+        },
+        "LifecycleConfigArns": {
+          "type": "array",
+          "description": "A list of LifecycleConfigArns available for use with JupyterServer apps.",
+          "uniqueItems": false,
+          "minItems": 0,
+          "maxItems": 30,
+          "items": {
+            "$ref": "#/definitions/StudioLifecycleConfigArn"
+          }
         }
       }
     },
@@ -223,6 +233,12 @@
           "description": "The ARN of the image version created on the instance.",
           "maxLength": 256,
           "pattern": "^arn:aws(-[\\w]+)*:sagemaker:.+:[0-9]{12}:image-version/[a-z0-9]([-.]?[a-z0-9])*/[0-9]+$"
+        },
+        "LifecycleConfigArn": {
+          "type": "string",
+          "description": "The Amazon Resource Name (ARN) of the Lifecycle Configuration to attach to the Resource.",
+          "maxLength": 256,
+          "pattern": "arn:aws[a-z\\-]*:sagemaker:[a-z0-9\\-]*:[0-9]{12}:studio-lifecycle-config/.*"
         }
       }
     },
@@ -244,6 +260,16 @@
         "DefaultResourceSpec": {
           "$ref": "#/definitions/ResourceSpec",
           "description": "The default instance type and the Amazon Resource Name (ARN) of the default SageMaker image used by the KernelGateway app."
+        },
+        "LifecycleConfigArns": {
+          "type": "array",
+          "description": "A list of LifecycleConfigArns available for use with KernelGateway apps.",
+          "uniqueItems": false,
+          "minItems": 0,
+          "maxItems": 30,
+          "items": {
+            "$ref": "#/definitions/StudioLifecycleConfigArn"
+          }
         }
       }
     },
diff --git a/internal/aws/cfn/schemas/aws/secretsmanager/resourcepolicy.json b/internal/aws/cfn/schemas/aws/secretsmanager/resourcepolicy.json
index cb829fc6..0f92d8d8 100644
--- a/internal/aws/cfn/schemas/aws/secretsmanager/resourcepolicy.json
+++ b/internal/aws/cfn/schemas/aws/secretsmanager/resourcepolicy.json
@@ -3,30 +3,76 @@
   "description": "Resource Type definition for AWS::SecretsManager::ResourcePolicy",
   "additionalProperties": false,
   "properties": {
-    "ResourcePolicy": {
-      "type": "object"
-    },
     "Id": {
-      "type": "string"
-    },
-    "BlockPublicPolicy": {
-      "type": "boolean"
+      "type": "string",
+      "description": "The Arn of the secret."
     },
     "SecretId": {
-      "type": "string"
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 2048,
+      "description": "The ARN or name of the secret to attach the resource-based policy."
+    },
+    "ResourcePolicy": {
+      "type": [
+        "string",
+        "object"
+      ],
+      "description": "A JSON-formatted string for an AWS resource-based policy."
+    },
+    "BlockPublicPolicy": {
+      "type": "boolean",
+      "description": "Specifies whether to block resource-based policies that allow broad access to the secret."
     }
   },
+  "tagging": {
+    "taggable": false
+  },
   "required": [
-    "SecretId",
-    "ResourcePolicy"
+    "ResourcePolicy",
+    "SecretId"
   ],
   "createOnlyProperties": [
     "/properties/SecretId"
   ],
+  "writeOnlyProperties": [
+    "/properties/BlockPublicPolicy"
+  ],
   "primaryIdentifier": [
     "/properties/Id"
   ],
   "readOnlyProperties": [
     "/properties/Id"
-  ]
+  ],
+  "handlers": {
+    "create": {
+      "permissions": [
+        "secretsmanager:PutResourcePolicy",
+        "secretsmanager:GetResourcePolicy"
+      ]
+    },
+    "read": {
+      "permissions": [
+        "secretsmanager:GetResourcePolicy"
+      ]
+    },
+    "update": {
+      "permissions": [
+        "secretsmanager:PutResourcePolicy",
+        "secretsmanager:GetResourcePolicy"
+      ]
+    },
+    "delete": {
+      "permissions": [
+        "secretsmanager:DeleteResourcePolicy",
+        "secretsmanager:GetResourcePolicy"
+      ]
+    },
+    "list": {
+      "permissions": [
+        "secretsmanager:GetResourcePolicy",
+        "secretsmanager:ListSecrets"
+      ]
+    }
+  }
 }
diff --git a/internal/aws/cfn/schemas/aws/shield/protectiongroup.json b/internal/aws/cfn/schemas/aws/shield/protectiongroup.json
index 0d775521..2d7ef15f 100644
--- a/internal/aws/cfn/schemas/aws/shield/protectiongroup.json
+++ b/internal/aws/cfn/schemas/aws/shield/protectiongroup.json
@@ -15,7 +15,12 @@
   "tagging": {
     "taggable": true,
     "tagProperty": "/properties/Tags",
-    "cloudFormationSystemTags": false
+    "cloudFormationSystemTags": false,
+    "permissions": [
+      "shield:ListTagsForResource",
+      "shield:UntagResource",
+      "shield:TagResource"
+    ]
   },
   "additionalProperties": false,
   "required": [
diff --git a/internal/aws/cfn/schemas/aws/workspacesweb/portal.json b/internal/aws/cfn/schemas/aws/workspacesweb/portal.json
index ee2b7ea3..3641fa10 100644
--- a/internal/aws/cfn/schemas/aws/workspacesweb/portal.json
+++ b/internal/aws/cfn/schemas/aws/workspacesweb/portal.json
@@ -216,6 +216,7 @@
         "kms:CreateGrant",
         "kms:GenerateDataKey",
         "kms:Decrypt",
+        "kms:DescribeKey",
         "ec2:CreateNetworkInterface",
         "ec2:CreateNetworkInterfacePermission",
         "ec2:DeleteNetworkInterface",
@@ -233,7 +234,8 @@
         "workspaces-web:GetPortal",
         "workspaces-web:GetPortalServiceProviderMetadata",
         "workspaces-web:ListTagsForResource",
-        "kms:Decrypt"
+        "kms:Decrypt",
+        "kms:DescribeKey"
       ]
     },
     "update": {
@@ -260,6 +262,7 @@
         "kms:Encrypt",
         "kms:GenerateDataKey",
         "kms:Decrypt",
+        "kms:DescribeKey",
         "ec2:CreateNetworkInterface",
         "ec2:CreateNetworkInterfacePermission",
         "ec2:DeleteNetworkInterface",
@@ -286,13 +289,15 @@
         "workspaces-web:DisassociateUserAccessLoggingSettings",
         "workspaces-web:DisassociateUserSettings",
         "kms:Decrypt",
+        "kms:DescribeKey",
         "sso:DeleteManagedApplicationInstance"
       ]
     },
     "list": {
       "permissions": [
         "workspaces-web:ListPortals",
-        "kms:Decrypt"
+        "kms:Decrypt",
+        "kms:DescribeKey"
       ]
     }
   },
diff --git a/internal/aws/cfn/schemas/aws/workspacesweb/usersettings.json b/internal/aws/cfn/schemas/aws/workspacesweb/usersettings.json
index cf99a37b..18547d1c 100644
--- a/internal/aws/cfn/schemas/aws/workspacesweb/usersettings.json
+++ b/internal/aws/cfn/schemas/aws/workspacesweb/usersettings.json
@@ -161,6 +161,9 @@
       "maxLength": 2048,
       "minLength": 20,
       "pattern": "^arn:[\\w+=\\/,.@-]+:[a-zA-Z0-9\\-]+:[a-zA-Z0-9\\-]*:[a-zA-Z0-9]{1,12}:[a-zA-Z]+(\\/[a-fA-F0-9\\-]{36})+$"
+    },
+    "DeepLinkAllowed": {
+      "$ref": "#/definitions/EnabledType"
     }
   },
   "required": [
diff --git a/internal/aws/cfn/schemas/aws/xray/group.json b/internal/aws/cfn/schemas/aws/xray/group.json
index 61e375b7..5401a3b8 100644
--- a/internal/aws/cfn/schemas/aws/xray/group.json
+++ b/internal/aws/cfn/schemas/aws/xray/group.json
@@ -71,6 +71,13 @@
   "required": [
     "GroupName"
   ],
+  "tagging": {
+    "taggable": true,
+    "tagOnCreate": true,
+    "tagUpdatable": true,
+    "cloudFormationSystemTags": true,
+    "tagProperty": "/properties/Tags"
+  },
   "handlers": {
     "create": {
       "permissions": [
diff --git a/internal/aws/cfn/schemas/aws/xray/samplingrule.json b/internal/aws/cfn/schemas/aws/xray/samplingrule.json
index e8a8bdbc..65e56161 100644
--- a/internal/aws/cfn/schemas/aws/xray/samplingrule.json
+++ b/internal/aws/cfn/schemas/aws/xray/samplingrule.json
@@ -233,6 +233,13 @@
       }
     }
   },
+  "tagging": {
+    "taggable": true,
+    "tagOnCreate": true,
+    "tagUpdatable": true,
+    "cloudFormationSystemTags": true,
+    "tagProperty": "/properties/Tags"
+  },
   "handlers": {
     "create": {
       "permissions": [
diff --git a/internal/config/version.go b/internal/config/version.go
index cfde2ecc..ec579c16 100644
--- a/internal/config/version.go
+++ b/internal/config/version.go
@@ -5,5 +5,5 @@ const (
 	NAME = "Rain"
 
 	// VERSION is the application's version string
-	VERSION = "v1.12.0"
+	VERSION = "v1.13.0"
 )
diff --git a/scripts/integ.sh b/scripts/integ.sh
index 11085b15..039b4874 100755
--- a/scripts/integ.sh
+++ b/scripts/integ.sh
@@ -8,15 +8,15 @@ set -eoux pipefail
 
 ./rain ls
 
-./rain deploy test/templates/success.template success-test -y --params BucketName=ezbeardatamazon-rain-test-1
+./rain deploy test/templates/success.template success-test3 -y --params BucketName=ezbeardatamazon-rain-test-1
 
-./rain cat success-test
+./rain cat success-test3
 
-./rain logs success-test
+./rain logs success-test3
 
-./rain logs --chart success-test
+./rain logs --chart success-test3
 
-./rain rm success-test -y
+./rain rm success-test3 -y
 
 # Unnamed stack
 ./rain deploy test/templates/success.template -y --params BucketName=ezbeardatamazon-rain-test-1
@@ -25,9 +25,15 @@ set -eoux pipefail
 ./rain rm -y success
 
 # Change sets
-./rain deploy --no-exec test/templates/success.template success-test success-changeset-name -y --params BucketName=ezbeardatamazon-rain-test-1
-./rain ls -c success-test success-changeset-name
-./rain rm -c -y success-test success-changeset-name
+# Create a named changeset
+./rain deploy --no-exec test/templates/success.template success-test3 success-changeset-name -y --params BucketName=ezbeardatamazon-rain-test-1
+./rain ls -c success-test3 success-changeset-name
+
+#./rain rm -c -y success-test3 success-changeset-name
+# This leaves the stack as review in progress, and then you can't delete it
+# Seems like a bug!
+# It also fails if we try to delete the stack, not just the stackset
+./rain rm -y success-test3 
 
 ./rain build AWS::S3::Bucket
 ./rain build -l