diff --git a/docs/index.md b/docs/index.md
index 29de9444..f477bc6e 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -36,4 +36,4 @@ Rain is a command line tool for working with AWS CloudFormation templates and st
 * [rain tree](rain_tree.md)	 - Find dependencies of Resources and Outputs in a local template
 * [rain watch](rain_watch.md)	 - Display an updating view of a CloudFormation stack
 
-###### Auto generated by spf13/cobra on 18-Jun-2024
+###### Auto generated by spf13/cobra on 19-Jun-2024
diff --git a/docs/rain_bootstrap.md b/docs/rain_bootstrap.md
index 20ad1f0d..3691e006 100644
--- a/docs/rain_bootstrap.md
+++ b/docs/rain_bootstrap.md
@@ -30,4 +30,4 @@ rain bootstrap
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 18-Jun-2024
+###### Auto generated by spf13/cobra on 19-Jun-2024
diff --git a/docs/rain_build.md b/docs/rain_build.md
index 45955c31..c6187651 100644
--- a/docs/rain_build.md
+++ b/docs/rain_build.md
@@ -41,4 +41,4 @@ rain build [<resource type>] or <prompt>
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 18-Jun-2024
+###### Auto generated by spf13/cobra on 19-Jun-2024
diff --git a/docs/rain_cat.md b/docs/rain_cat.md
index 56ed2308..fbc9787d 100644
--- a/docs/rain_cat.md
+++ b/docs/rain_cat.md
@@ -35,4 +35,4 @@ rain cat <stack>
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 18-Jun-2024
+###### Auto generated by spf13/cobra on 19-Jun-2024
diff --git a/docs/rain_cc.md b/docs/rain_cc.md
index 24971e55..2baab7c2 100644
--- a/docs/rain_cc.md
+++ b/docs/rain_cc.md
@@ -32,4 +32,4 @@ You must pass the --experimental (-x) flag to use this command, to acknowledge t
 * [rain cc rm](rain_cc_rm.md)	 - Delete a deployment created by cc deploy (Experimental!)
 * [rain cc state](rain_cc_state.md)	 - Download the state file for a template deployed with cc deploy
 
-###### Auto generated by spf13/cobra on 18-Jun-2024
+###### Auto generated by spf13/cobra on 19-Jun-2024
diff --git a/docs/rain_cc_deploy.md b/docs/rain_cc_deploy.md
index f7681386..0c959848 100644
--- a/docs/rain_cc_deploy.md
+++ b/docs/rain_cc_deploy.md
@@ -40,4 +40,4 @@ rain cc deploy <template> <name>
 
 * [rain cc](rain_cc.md)	 - Interact with templates using Cloud Control API instead of CloudFormation
 
-###### Auto generated by spf13/cobra on 18-Jun-2024
+###### Auto generated by spf13/cobra on 19-Jun-2024
diff --git a/docs/rain_cc_drift.md b/docs/rain_cc_drift.md
index 5fd7291e..e47e784c 100644
--- a/docs/rain_cc_drift.md
+++ b/docs/rain_cc_drift.md
@@ -33,4 +33,4 @@ rain cc drift <name>
 
 * [rain cc](rain_cc.md)	 - Interact with templates using Cloud Control API instead of CloudFormation
 
-###### Auto generated by spf13/cobra on 18-Jun-2024
+###### Auto generated by spf13/cobra on 19-Jun-2024
diff --git a/docs/rain_cc_rm.md b/docs/rain_cc_rm.md
index 33e10782..5d442df6 100644
--- a/docs/rain_cc_rm.md
+++ b/docs/rain_cc_rm.md
@@ -33,4 +33,4 @@ rain cc rm <name>
 
 * [rain cc](rain_cc.md)	 - Interact with templates using Cloud Control API instead of CloudFormation
 
-###### Auto generated by spf13/cobra on 18-Jun-2024
+###### Auto generated by spf13/cobra on 19-Jun-2024
diff --git a/docs/rain_cc_state.md b/docs/rain_cc_state.md
index 309ab3ba..a8b5501e 100644
--- a/docs/rain_cc_state.md
+++ b/docs/rain_cc_state.md
@@ -33,4 +33,4 @@ rain cc state <name>
 
 * [rain cc](rain_cc.md)	 - Interact with templates using Cloud Control API instead of CloudFormation
 
-###### Auto generated by spf13/cobra on 18-Jun-2024
+###### Auto generated by spf13/cobra on 19-Jun-2024
diff --git a/docs/rain_console.md b/docs/rain_console.md
index 9e691f33..782983d3 100644
--- a/docs/rain_console.md
+++ b/docs/rain_console.md
@@ -39,4 +39,4 @@ rain console [stack]
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 18-Jun-2024
+###### Auto generated by spf13/cobra on 19-Jun-2024
diff --git a/docs/rain_deploy.md b/docs/rain_deploy.md
index 6809cdd0..f30747ba 100644
--- a/docs/rain_deploy.md
+++ b/docs/rain_deploy.md
@@ -85,4 +85,4 @@ rain deploy <template> [stack]
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 18-Jun-2024
+###### Auto generated by spf13/cobra on 19-Jun-2024
diff --git a/docs/rain_diff.md b/docs/rain_diff.md
index 019e51b2..be2934d2 100644
--- a/docs/rain_diff.md
+++ b/docs/rain_diff.md
@@ -28,4 +28,4 @@ rain diff <from> <to>
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 18-Jun-2024
+###### Auto generated by spf13/cobra on 19-Jun-2024
diff --git a/docs/rain_fmt.md b/docs/rain_fmt.md
index 83f57e86..89fc24fb 100644
--- a/docs/rain_fmt.md
+++ b/docs/rain_fmt.md
@@ -37,4 +37,4 @@ rain fmt <filename>...
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 18-Jun-2024
+###### Auto generated by spf13/cobra on 19-Jun-2024
diff --git a/docs/rain_forecast.md b/docs/rain_forecast.md
index e529c5da..d2cc6913 100644
--- a/docs/rain_forecast.md
+++ b/docs/rain_forecast.md
@@ -53,4 +53,4 @@ rain forecast --experimental <template> [stackName]
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 18-Jun-2024
+###### Auto generated by spf13/cobra on 19-Jun-2024
diff --git a/docs/rain_info.md b/docs/rain_info.md
index 6215c3dc..2b0d6ecb 100644
--- a/docs/rain_info.md
+++ b/docs/rain_info.md
@@ -30,4 +30,4 @@ rain info
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 18-Jun-2024
+###### Auto generated by spf13/cobra on 19-Jun-2024
diff --git a/docs/rain_logs.md b/docs/rain_logs.md
index cd55ea44..6f41e7d9 100644
--- a/docs/rain_logs.md
+++ b/docs/rain_logs.md
@@ -37,4 +37,4 @@ rain logs <stack> (<resource>)
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 18-Jun-2024
+###### Auto generated by spf13/cobra on 19-Jun-2024
diff --git a/docs/rain_ls.md b/docs/rain_ls.md
index 7a92bcb0..043d5163 100644
--- a/docs/rain_ls.md
+++ b/docs/rain_ls.md
@@ -31,4 +31,4 @@ rain ls <stack> [changeset]
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 18-Jun-2024
+###### Auto generated by spf13/cobra on 19-Jun-2024
diff --git a/docs/rain_merge.md b/docs/rain_merge.md
index 052109d0..5157f348 100644
--- a/docs/rain_merge.md
+++ b/docs/rain_merge.md
@@ -29,4 +29,4 @@ rain merge <template> <template> ...
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 18-Jun-2024
+###### Auto generated by spf13/cobra on 19-Jun-2024
diff --git a/docs/rain_module.md b/docs/rain_module.md
index b1dfe69c..e93d8d71 100644
--- a/docs/rain_module.md
+++ b/docs/rain_module.md
@@ -31,4 +31,4 @@ The rain module command can be used to publish modules to CodeArtifact, and to i
 * [rain module install](rain_module_install.md)	 - Install a package of Rain modules from CodeArtifact
 * [rain module publish](rain_module_publish.md)	 - Publish a directory of Rain modules to CodeArtifact
 
-###### Auto generated by spf13/cobra on 18-Jun-2024
+###### Auto generated by spf13/cobra on 19-Jun-2024
diff --git a/docs/rain_module_bootstrap.md b/docs/rain_module_bootstrap.md
index f0dc8c00..e1aee4c4 100644
--- a/docs/rain_module_bootstrap.md
+++ b/docs/rain_module_bootstrap.md
@@ -29,4 +29,4 @@ rain module bootstrap [flags]
 
 * [rain module](rain_module.md)	 - Interact with Rain modules in CodeArtifact
 
-###### Auto generated by spf13/cobra on 18-Jun-2024
+###### Auto generated by spf13/cobra on 19-Jun-2024
diff --git a/docs/rain_module_install.md b/docs/rain_module_install.md
index 9cd99c96..f113008a 100644
--- a/docs/rain_module_install.md
+++ b/docs/rain_module_install.md
@@ -30,4 +30,4 @@ rain module install <name> [flags]
 
 * [rain module](rain_module.md)	 - Interact with Rain modules in CodeArtifact
 
-###### Auto generated by spf13/cobra on 18-Jun-2024
+###### Auto generated by spf13/cobra on 19-Jun-2024
diff --git a/docs/rain_module_publish.md b/docs/rain_module_publish.md
index e3aa98a9..f5f975d3 100644
--- a/docs/rain_module_publish.md
+++ b/docs/rain_module_publish.md
@@ -30,4 +30,4 @@ rain module publish <name> [flags]
 
 * [rain module](rain_module.md)	 - Interact with Rain modules in CodeArtifact
 
-###### Auto generated by spf13/cobra on 18-Jun-2024
+###### Auto generated by spf13/cobra on 19-Jun-2024
diff --git a/docs/rain_pkg.md b/docs/rain_pkg.md
index d94a5779..efa96463 100644
--- a/docs/rain_pkg.md
+++ b/docs/rain_pkg.md
@@ -68,4 +68,4 @@ rain pkg <template>
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 18-Jun-2024
+###### Auto generated by spf13/cobra on 19-Jun-2024
diff --git a/docs/rain_rm.md b/docs/rain_rm.md
index 996ac7dc..c6af3f0b 100644
--- a/docs/rain_rm.md
+++ b/docs/rain_rm.md
@@ -33,4 +33,4 @@ rain rm <stack> [changeset]
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 18-Jun-2024
+###### Auto generated by spf13/cobra on 19-Jun-2024
diff --git a/docs/rain_stackset.md b/docs/rain_stackset.md
index 83551deb..91ebf307 100644
--- a/docs/rain_stackset.md
+++ b/docs/rain_stackset.md
@@ -28,4 +28,4 @@ This command manipulates stack sets. It has no action if specific stack set comm
 * [rain stackset ls](rain_stackset_ls.md)	 - List a CloudFormation stack sets in a given region
 * [rain stackset rm](rain_stackset_rm.md)	 - Delete a CloudFormation stack set and/or its instances.
 
-###### Auto generated by spf13/cobra on 18-Jun-2024
+###### Auto generated by spf13/cobra on 19-Jun-2024
diff --git a/docs/rain_stackset_deploy.md b/docs/rain_stackset_deploy.md
index 5440d28c..a99881e8 100644
--- a/docs/rain_stackset_deploy.md
+++ b/docs/rain_stackset_deploy.md
@@ -65,4 +65,4 @@ rain stackset deploy <template> [stackset] [flags]
 
 * [rain stackset](rain_stackset.md)	 - This command manipulates stack sets.
 
-###### Auto generated by spf13/cobra on 18-Jun-2024
+###### Auto generated by spf13/cobra on 19-Jun-2024
diff --git a/docs/rain_stackset_ls.md b/docs/rain_stackset_ls.md
index c2fece78..0d097525 100644
--- a/docs/rain_stackset_ls.md
+++ b/docs/rain_stackset_ls.md
@@ -31,4 +31,4 @@ rain stackset ls <stack set>
 
 * [rain stackset](rain_stackset.md)	 - This command manipulates stack sets.
 
-###### Auto generated by spf13/cobra on 18-Jun-2024
+###### Auto generated by spf13/cobra on 19-Jun-2024
diff --git a/docs/rain_stackset_rm.md b/docs/rain_stackset_rm.md
index 67498498..499fabeb 100644
--- a/docs/rain_stackset_rm.md
+++ b/docs/rain_stackset_rm.md
@@ -31,4 +31,4 @@ rain stackset rm <stackset>
 
 * [rain stackset](rain_stackset.md)	 - This command manipulates stack sets.
 
-###### Auto generated by spf13/cobra on 18-Jun-2024
+###### Auto generated by spf13/cobra on 19-Jun-2024
diff --git a/docs/rain_tree.md b/docs/rain_tree.md
index 491f63e7..45220327 100644
--- a/docs/rain_tree.md
+++ b/docs/rain_tree.md
@@ -30,4 +30,4 @@ rain tree [template]
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 18-Jun-2024
+###### Auto generated by spf13/cobra on 19-Jun-2024
diff --git a/docs/rain_watch.md b/docs/rain_watch.md
index 3ec6c544..17854bff 100644
--- a/docs/rain_watch.md
+++ b/docs/rain_watch.md
@@ -30,4 +30,4 @@ rain watch <stack>
 
 * [rain](index.md)	 - 
 
-###### Auto generated by spf13/cobra on 18-Jun-2024
+###### Auto generated by spf13/cobra on 19-Jun-2024
diff --git a/go.mod b/go.mod
index c94c0e2d..b77c652f 100644
--- a/go.mod
+++ b/go.mod
@@ -7,21 +7,21 @@ toolchain go1.22.4
 require (
 	//github.com/ake-persson/mapslice-json v0.0.0-20210720081907-22c8edf57807
 	github.com/appscode/jsonpatch v1.0.1
-	github.com/aws/aws-sdk-go-v2 v1.27.1
-	github.com/aws/aws-sdk-go-v2/config v1.27.17
-	github.com/aws/aws-sdk-go-v2/credentials v1.17.17
-	github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.9.1
-	github.com/aws/aws-sdk-go-v2/service/cloudformation v1.51.2
-	github.com/aws/aws-sdk-go-v2/service/ec2 v1.163.0
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.54.4
-	github.com/aws/aws-sdk-go-v2/service/sts v1.28.11
+	github.com/aws/aws-sdk-go-v2 v1.30.0
+	github.com/aws/aws-sdk-go-v2/config v1.27.21
+	github.com/aws/aws-sdk-go-v2/credentials v1.17.21
+	github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.10.1
+	github.com/aws/aws-sdk-go-v2/service/cloudformation v1.52.1
+	github.com/aws/aws-sdk-go-v2/service/ec2 v1.165.1
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.56.1
+	github.com/aws/aws-sdk-go-v2/service/sts v1.29.1
 	github.com/aws/smithy-go v1.20.2
 	github.com/chzyer/readline v1.5.1
 	github.com/google/go-cmp v0.6.0
 	github.com/google/uuid v1.6.0
 	github.com/gookit/color v1.5.4
 	github.com/nathan-fiscaletti/consolesize-go v0.0.0-20220204101620-317176b6684d
-	github.com/spf13/cobra v1.8.0
+	github.com/spf13/cobra v1.8.1
 	github.com/spf13/pflag v1.0.5
 	golang.org/x/sys v0.21.0
 	golang.org/x/term v0.21.0
@@ -29,14 +29,14 @@ require (
 )
 
 require (
-	github.com/apple/pkl-go v0.6.1-0.20240531164128-56cbddc609af
-	github.com/aws/aws-sdk-go-v2/service/acm v1.26.1
-	github.com/aws/aws-sdk-go-v2/service/codeartifact v1.27.5
-	github.com/aws/aws-sdk-go-v2/service/kms v1.32.2
-	github.com/aws/aws-sdk-go-v2/service/lightsail v1.38.2
-	github.com/aws/aws-sdk-go-v2/service/rds v1.79.5
-	github.com/aws/aws-sdk-go-v2/service/servicequotas v1.21.9
-	github.com/aws/aws-sdk-go-v2/service/ssm v1.50.5
+	github.com/apple/pkl-go v0.7.0
+	github.com/aws/aws-sdk-go-v2/service/acm v1.27.1
+	github.com/aws/aws-sdk-go-v2/service/codeartifact v1.28.1
+	github.com/aws/aws-sdk-go-v2/service/kms v1.34.1
+	github.com/aws/aws-sdk-go-v2/service/lightsail v1.39.1
+	github.com/aws/aws-sdk-go-v2/service/rds v1.80.1
+	github.com/aws/aws-sdk-go-v2/service/servicequotas v1.22.1
+	github.com/aws/aws-sdk-go-v2/service/ssm v1.51.1
 	github.com/fatih/color v1.17.0
 	github.com/manifoldco/promptui v0.9.0
 	github.com/mattn/go-runewidth v0.0.15
@@ -44,8 +44,8 @@ require (
 )
 
 require (
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.8 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.24.4 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.12 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.25.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
@@ -57,22 +57,22 @@ require (
 
 require (
 	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.2 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.4 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.8 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.8 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.8 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.12 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.12 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/cloudcontrol v1.18.9
-	github.com/aws/aws-sdk-go-v2/service/iam v1.32.5
+	github.com/aws/aws-sdk-go-v2/service/cloudcontrol v1.19.1
+	github.com/aws/aws-sdk-go-v2/service/iam v1.33.1
 	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.3.10 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.10 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.17.8 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.20.10 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.3.14 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.14 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.17.12 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.21.1 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.4 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
-	golang.org/x/exp v0.0.0-20240604190554-fc45aab8b7f8
+	golang.org/x/exp v0.0.0-20240613232115-7f521ea00fb8
 	gopkg.in/yaml.v2 v2.4.0
 )
diff --git a/go.sum b/go.sum
index c3e24603..f282fc72 100644
--- a/go.sum
+++ b/go.sum
@@ -1,65 +1,119 @@
 github.com/apple/pkl-go v0.6.1-0.20240531164128-56cbddc609af h1:tc3+aUeT3GEcJj2Fcbzmh9HdXhJPPxbQ10a96dM+/YE=
 github.com/apple/pkl-go v0.6.1-0.20240531164128-56cbddc609af/go.mod h1:5Hwil5tyZGrOekh7JXLZJvIAcGHb4gT19lnv4WEiKeI=
+github.com/apple/pkl-go v0.7.0 h1:tn21SeH8QN/hdWsUg+ys/ItQem5WM9WuvjAwql3Gm14=
+github.com/apple/pkl-go v0.7.0/go.mod h1:5Hwil5tyZGrOekh7JXLZJvIAcGHb4gT19lnv4WEiKeI=
 github.com/appscode/jsonpatch v1.0.1 h1:e82Bj+rsBSnpsmjiIGlc9NiKSBpJONZkamk/F8GrCR0=
 github.com/appscode/jsonpatch v1.0.1/go.mod h1:4AJxUpXUhv4N+ziTvIcWWXgeorXpxPZOfk9HdEVr96M=
 github.com/aws/aws-sdk-go-v2 v1.27.1 h1:xypCL2owhog46iFxBKKpBcw+bPTX/RJzwNj8uSilENw=
 github.com/aws/aws-sdk-go-v2 v1.27.1/go.mod h1:ffIFB97e2yNsv4aTSGkqtHnppsIJzw7G7BReUZ3jCXM=
+github.com/aws/aws-sdk-go-v2 v1.30.0 h1:6qAwtzlfcTtcL8NHtbDQAqgM5s6NDipQTkPxyH/6kAA=
+github.com/aws/aws-sdk-go-v2 v1.30.0/go.mod h1:ffIFB97e2yNsv4aTSGkqtHnppsIJzw7G7BReUZ3jCXM=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.2 h1:x6xsQXGSmW6frevwDA+vi/wqhp1ct18mVXYN08/93to=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.2/go.mod h1:lPprDr1e6cJdyYeGXnRaJoP4Md+cDBvi2eOj00BlGmg=
 github.com/aws/aws-sdk-go-v2/config v1.27.17 h1:L0JZN7Gh7pT6u5CJReKsLhGKparqNKui+mcpxMXjDZc=
 github.com/aws/aws-sdk-go-v2/config v1.27.17/go.mod h1:MzM3balLZeaafYcPz8IihAmam/aCz6niPQI0FdprxW0=
+github.com/aws/aws-sdk-go-v2/config v1.27.21 h1:yPX3pjGCe2hJsetlmGNB4Mngu7UPmvWPzzWCv1+boeM=
+github.com/aws/aws-sdk-go-v2/config v1.27.21/go.mod h1:4XtlEU6DzNai8RMbjSF5MgGZtYvrhBP/aKZcRtZAVdM=
 github.com/aws/aws-sdk-go-v2/credentials v1.17.17 h1:b3Dk9uxQByS9sc6r0sc2jmxsJKO75eOcb9nNEiaUBLM=
 github.com/aws/aws-sdk-go-v2/credentials v1.17.17/go.mod h1:e4khg9iY08LnFK/HXQDWMf9GDaiMari7jWPnXvKAuBU=
+github.com/aws/aws-sdk-go-v2/credentials v1.17.21 h1:pjAqgzfgFhTv5grc7xPHtXCAaMapzmwA7aU+c/SZQGw=
+github.com/aws/aws-sdk-go-v2/credentials v1.17.21/go.mod h1:nhK6PtBlfHTUDVmBLr1dg+WHCOCK+1Fu/WQyVHPsgNQ=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.4 h1:0cSfTYYL9qiRcdi4Dvz+8s3JUgNR2qvbgZkXcwPEEEk=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.4/go.mod h1:Wjn5O9eS7uSi7vlPKt/v0MLTncANn9EMmoDvnzJli6o=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.8 h1:FR+oWPFb/8qMVYMWN98bUZAGqPvLHiyqg1wqQGfUAXY=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.8/go.mod h1:EgSKcHiuuakEIxJcKGzVNWh5srVAQ3jKaSrBGRYvM48=
 github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.8 h1:RnLB7p6aaFMRfyQkD6ckxR7myCC9SABIqSz4czYUUbU=
 github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.8/go.mod h1:XH7dQJd+56wEbP1I4e4Duo+QhSMxNArE8VP7NuUOTeM=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.12 h1:SJ04WXGTwnHlWIODtC5kJzKbeuHt+OUNOgKg7nfnUGw=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.12/go.mod h1:FkpvXhA92gb3GE9LD6Og0pHHycTxW7xGpnEh5E7Opwo=
 github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.8 h1:jzApk2f58L9yW9q1GEab3BMMFWUkkiZhyrRUtbwUbKU=
 github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.8/go.mod h1:WqO+FftfO3tGePUtQxPXM6iODVfqMwsVMgTbG/ZXIdQ=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.12 h1:hb5KgeYfObi5MHkSSZMEudnIvX30iB+E21evI4r6BnQ=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.12/go.mod h1:CroKe/eWJdyfy9Vx4rljP5wTUjNJfb+fPz1uMYUhEGM=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 h1:hT8rVHwugYE2lEfdFE0QWVo81lF7jMrYJVDWI+f+VxU=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0/go.mod h1:8tu/lYfQfFe6IGnaOdrpVgEL2IrrDOf6/m9RQum4NkY=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.8 h1:jH33S0y5Bo5ZVML62JgZhjd/LrtU+vbR8W7XnIE3Srk=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.8/go.mod h1:hD5YwHLOy6k7d6kqcn3me1bFWHOtzhaXstMd6BpdB68=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.12 h1:DXFWyt7ymx/l1ygdyTTS0X923e+Q2wXIxConJzrgwc0=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.12/go.mod h1:mVOr/LbvaNySK1/BTy4cBOCjhCNY2raWBwK4v+WR5J4=
 github.com/aws/aws-sdk-go-v2/service/acm v1.26.1 h1:W4o6dIMmPWjl55ZE2ycdBvE1Q/KOLFqCzVNHeLTyrlM=
 github.com/aws/aws-sdk-go-v2/service/acm v1.26.1/go.mod h1:89Ze+u79IkUA44zjubmbg1HDPSGp1SI1JuuUUiJOzAU=
+github.com/aws/aws-sdk-go-v2/service/acm v1.27.1 h1:EMnuoQ/WR4/VNE8QmFrXq4u0BZH2Xhc9Yr41xZlths0=
+github.com/aws/aws-sdk-go-v2/service/acm v1.27.1/go.mod h1:wHw2SsqkXuys0SArqz+Rb7LGvujWSnlPByxCm6q7kus=
 github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.9.1 h1:8Ct21/s9kXoryJD2WwDgRc1G4sCELVYNl0/DK6QZnYM=
 github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.9.1/go.mod h1:rvgvxI+uusKEiUNDcASdNpmfhKlYtReLKmYM0VjFIYM=
+github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.10.1 h1:IvYkZ/7XXbEaTGCL3XA5YcZ97ts0iZMkyah0XaKj5Zo=
+github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.10.1/go.mod h1:vHk9LI9clsbT8DYUmHtBxinKBlnp4XvxqyaCXA7J2bY=
 github.com/aws/aws-sdk-go-v2/service/cloudcontrol v1.18.9 h1:Wp1QFv8uyNpwPXSI/a6TRkIR0CiT+Fa60s5vVTsFdXM=
 github.com/aws/aws-sdk-go-v2/service/cloudcontrol v1.18.9/go.mod h1:pFrHzOZRN/EfWL7ygk9ELdQHqRGERgOgP03OLIOlQV4=
+github.com/aws/aws-sdk-go-v2/service/cloudcontrol v1.19.1 h1:xje03QCAf/8b1Ntsx/QR4oTn0tMIshVT/OUAilcwcO0=
+github.com/aws/aws-sdk-go-v2/service/cloudcontrol v1.19.1/go.mod h1:4hiczFeqZEQy8yX5/uY1rgXKnOXam6GAoWZrFEfoyMY=
 github.com/aws/aws-sdk-go-v2/service/cloudformation v1.51.2 h1:FBc+xcfqpBzYl6WWIBk3AB9d/oc6r2sn/mYPnuORCFI=
 github.com/aws/aws-sdk-go-v2/service/cloudformation v1.51.2/go.mod h1:qadtdULA3L3WyTz7ybmu46Motr8ckS+zGZS+4oXLxH0=
+github.com/aws/aws-sdk-go-v2/service/cloudformation v1.52.1 h1:Ts+mCjOtt8o2k2vnWnX/0sE0eSmEVWBvfJkNrNMQlAo=
+github.com/aws/aws-sdk-go-v2/service/cloudformation v1.52.1/go.mod h1:IrWhabzdTEc651GAq7rgst/SYcEqqcD7Avr82m28AAU=
 github.com/aws/aws-sdk-go-v2/service/codeartifact v1.27.5 h1:vrPOyJJ4Ph445jYq+1jFEpgmZhwHe9WX2V4OylzOV9M=
 github.com/aws/aws-sdk-go-v2/service/codeartifact v1.27.5/go.mod h1:Jk7hUaInLPjpZc1NzwB0gNYghUJLm9AvwfKuAsGq4A0=
+github.com/aws/aws-sdk-go-v2/service/codeartifact v1.28.1 h1:1OfXVziIGFVm5FHvDkWogdHUkXlZZwqe/0LCbxnmfYA=
+github.com/aws/aws-sdk-go-v2/service/codeartifact v1.28.1/go.mod h1:XKoFW8gDY8bULuq8+sKHrMqsbnVi9MTkeJmf69ZxoLk=
 github.com/aws/aws-sdk-go-v2/service/ec2 v1.163.0 h1:gwthjSMr5tW2fYBJNt3LQGgtkREvv5IcuaWRjeo1fh0=
 github.com/aws/aws-sdk-go-v2/service/ec2 v1.163.0/go.mod h1:eu3DWRK5GBq4hjCr7nAbnQiHSan5RJ6ue3qQVp5PJs0=
+github.com/aws/aws-sdk-go-v2/service/ec2 v1.165.1 h1:LkSnU1c9JKJyXYcwpWgQGuwctwv3pDenMUgH2CmLd1A=
+github.com/aws/aws-sdk-go-v2/service/ec2 v1.165.1/go.mod h1:Wv7N3iFOKVsZNIaw9MOBUmwCkX6VMmQQRFhMrHtNGno=
 github.com/aws/aws-sdk-go-v2/service/iam v1.32.5 h1:G2judWqHbm2bDrmJPj9W0nD3Pv8+WzhY+fAAEQMpLf4=
 github.com/aws/aws-sdk-go-v2/service/iam v1.32.5/go.mod h1:RorjhuicJ7tEwun17BEeD//1JiPdvxPv15KOa9BKxS8=
+github.com/aws/aws-sdk-go-v2/service/iam v1.33.1 h1:0dcMo3330L9LIckl+4iujMoq0AdR8LMK0TtgrjHUi6M=
+github.com/aws/aws-sdk-go-v2/service/iam v1.33.1/go.mod h1:sX/naR5tYtlGFN0Bjg9VPNgYNg/rqiDUuKTW9peFnZk=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.2 h1:Ji0DY1xUsUr3I8cHps0G+XM3WWU16lP6yG8qu1GAZAs=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.2/go.mod h1:5CsjAbs3NlGQyZNFACh+zztPDI7fU6eW9QsxjfnuBKg=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.3.10 h1:pkYC5zTOSPXEYJj56b2SOik9AL432i5MT1YVTQbKOK0=
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.3.10/go.mod h1:/WNsBOlKWZCG3PMh2aSp8vkyyT/clpMZqOtrnIKqGfk=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.3.14 h1:oWccitSnByVU74rQRHac4gLfDqjB6Z1YQGOY/dXKedI=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.3.14/go.mod h1:8SaZBlQdCLrc/2U3CEO48rYj9uR8qRsPRkmzwNM52pM=
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.10 h1:7kZqP7akv0enu6ykJhb9OYlw16oOrSy+Epus8o/VqMY=
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.10/go.mod h1:gYVF3nM1ApfTRDj9pvdhootBb8WbiIejuqn4w8ruMes=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.14 h1:zSDPny/pVnkqABXYRicYuPf9z2bTqfH13HT3v6UheIk=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.14/go.mod h1:3TTcI5JSzda1nw/pkVC9dhgLre0SNBFj2lYS4GctXKI=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.17.8 h1:iQNXVs1vtaq+y9M90M4ZIVNORje0qXTscqHLqoOnFS0=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.17.8/go.mod h1:yUQPRlWqGG0lfNsmjbRWKVwgilfBtZTOFSLEYALlAig=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.17.12 h1:tzha+v1SCEBpXWEuw6B/+jm4h5z8hZbTpXz0zRZqTnw=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.17.12/go.mod h1:n+nt2qjHGoseWeLHt1vEr6ZRCCxIN2KcNpJxBcYQSwI=
 github.com/aws/aws-sdk-go-v2/service/kms v1.32.2 h1:WuwRxTSPc+E4dwDRmxh4TILJsnYoqm41KTb11pRkzBA=
 github.com/aws/aws-sdk-go-v2/service/kms v1.32.2/go.mod h1:qEy625xFxrw6hA+eOAD030wmLERPa7LNCArh+gAC+8o=
+github.com/aws/aws-sdk-go-v2/service/kms v1.34.1 h1:VsKBn6WADI3Nn3WjBMzeRww9WHXeVLi7zyuSrqjRCBQ=
+github.com/aws/aws-sdk-go-v2/service/kms v1.34.1/go.mod h1:5F6kXrPBxv0l1t8EO44GuG4W82jGJwaRE0B+suEGnNY=
 github.com/aws/aws-sdk-go-v2/service/lightsail v1.38.2 h1:4w4lsdD8PTa5JuAmOodlcJUh79Fexq/ISWAFjRePSKU=
 github.com/aws/aws-sdk-go-v2/service/lightsail v1.38.2/go.mod h1:UdEU45WZi2j7BCKUT++AUSUgl/gSuyoVzCowpbdRbwI=
+github.com/aws/aws-sdk-go-v2/service/lightsail v1.39.1 h1:OIdINTNLFOqm7t91ew7+CgcIkvDCCTuK4rBuREBAC2Q=
+github.com/aws/aws-sdk-go-v2/service/lightsail v1.39.1/go.mod h1:nP29+6YQpLvD/o/8SXaaSVFdRdPCpLLZv6MVAFiPqIQ=
 github.com/aws/aws-sdk-go-v2/service/rds v1.79.5 h1:vCMSFBiXtrr6fhNnGs1d2pw+/wJek0l2kZrS0cjtybs=
 github.com/aws/aws-sdk-go-v2/service/rds v1.79.5/go.mod h1:esGFn2z+QNa/XcjHevnddtp3RiFQ9/pzHbjl0rgYqDE=
+github.com/aws/aws-sdk-go-v2/service/rds v1.80.1 h1:o0DyV3AWeuAwrBVeoW/kCZJi4oGCBHPS3E5Ppmc3fLE=
+github.com/aws/aws-sdk-go-v2/service/rds v1.80.1/go.mod h1:lmaCww9B42S2WBaJNa5v+HeRpoGO+9gO+SwYJtNV8mw=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.54.4 h1:4p9SCdZBO0PdEXLTF2fcQuxOEkEiqPQpK824cP2VKRo=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.54.4/go.mod h1:oSkRFuHVWmUY4Ssk16ErGzBqvYEbvORJFzFXzWhTB2s=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.56.1 h1:wsg9Z/vNnCmxWikfGIoOlnExtEU459cR+2d+iDJ8elo=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.56.1/go.mod h1:8rDw3mVwmvIWWX/+LWY3PPIMZuwnQdJMCt0iVFVT3qw=
 github.com/aws/aws-sdk-go-v2/service/servicequotas v1.21.9 h1:3o5zcwZYvte3CeaYpLaWafwCSkJpclPXI5KSH+lXB90=
 github.com/aws/aws-sdk-go-v2/service/servicequotas v1.21.9/go.mod h1:QZpGkzlec0TPr8CA2Td5zRUJBC5+104ib0MusH5UVfI=
+github.com/aws/aws-sdk-go-v2/service/servicequotas v1.22.1 h1:QsHvqtdy0mGzpg/A+1lZX1ilf05Vuh2rSBzNJ3f3T1I=
+github.com/aws/aws-sdk-go-v2/service/servicequotas v1.22.1/go.mod h1:PyGv4oTed21K85Eu27j4u/8QyMlMHI0MivoNzziG6fg=
 github.com/aws/aws-sdk-go-v2/service/ssm v1.50.5 h1:k4IdBvCLRuKW2RyOMdeuNAIX2rRp682M0Y78TdwFY1Q=
 github.com/aws/aws-sdk-go-v2/service/ssm v1.50.5/go.mod h1:zBEScRRmXJYBoXrmdPFUuU+KDrg3+M/91gqyG7Vf3JU=
+github.com/aws/aws-sdk-go-v2/service/ssm v1.51.1 h1:MuFdaoXYgw4CPsiSa2G/T5CGOuSk90lb/eSTa+lRp9I=
+github.com/aws/aws-sdk-go-v2/service/ssm v1.51.1/go.mod h1:pC8vyMIahlJIUKdXBto0R+JzoTK7+iEplKqq7DbWodY=
 github.com/aws/aws-sdk-go-v2/service/sso v1.20.10 h1:ItKVmFwbyb/ZnCWf+nu3XBVmUirpO9eGEQd7urnBA0s=
 github.com/aws/aws-sdk-go-v2/service/sso v1.20.10/go.mod h1:5XKooCTi9VB/xZmJDvh7uZ+v3uQ7QdX6diOyhvPA+/w=
+github.com/aws/aws-sdk-go-v2/service/sso v1.21.1 h1:sd0BsnAvLH8gsp2e3cbaIr+9D7T1xugueQ7V/zUAsS4=
+github.com/aws/aws-sdk-go-v2/service/sso v1.21.1/go.mod h1:lcQG/MmxydijbeTOp04hIuJwXGWPZGI3bwdFDGRTv14=
 github.com/aws/aws-sdk-go-v2/service/ssooidc v1.24.4 h1:QMSCYDg3Iyls0KZc/dk3JtS2c1lFfqbmYO10qBPPkJk=
 github.com/aws/aws-sdk-go-v2/service/ssooidc v1.24.4/go.mod h1:MZ/PVYU/mRbmSF6WK3ybCYHjA2mig8utVokDEVLDgE0=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.25.1 h1:1uEFNNskK/I1KoZ9Q8wJxMz5V9jyBlsiaNrM7vA3YUQ=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.25.1/go.mod h1:z0P8K+cBIsFXUr5rzo/psUeJ20XjPN0+Nn8067Nd+E4=
 github.com/aws/aws-sdk-go-v2/service/sts v1.28.11 h1:HYS0csS7UJxdYRoG+bGgUYrSwVnV3/ece/wHm90TApM=
 github.com/aws/aws-sdk-go-v2/service/sts v1.28.11/go.mod h1:QXnthRM35zI92048MMwfFChjFmoufTdhtHmouwNfhhU=
+github.com/aws/aws-sdk-go-v2/service/sts v1.29.1 h1:myX5CxqXE0QMZNja6FA1/FSE3Vu1rVmeUmpJMMzeZg0=
+github.com/aws/aws-sdk-go-v2/service/sts v1.29.1/go.mod h1:N2mQiucsO0VwK9CYuS4/c2n6Smeh1v47Rz3dWCPFLdE=
 github.com/aws/smithy-go v1.20.2 h1:tbp628ireGtzcHDDmLT/6ADHidqnwgF57XOXZe6tp4Q=
 github.com/aws/smithy-go v1.20.2/go.mod h1:krry+ya/rV9RDcV/Q16kpu6ypI4K2czasz0NC3qS14E=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
@@ -112,6 +166,8 @@ github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/spf13/cobra v1.8.0 h1:7aJaZx1B85qltLMc546zn58BxxfZdR/W22ej9CFoEf0=
 github.com/spf13/cobra v1.8.0/go.mod h1:WXLWApfZ71AjXPya3WOlMsY9yMs7YeiHhFVlvLyhcho=
+github.com/spf13/cobra v1.8.1 h1:e5/vxKd/rZsfSJMUX1agtjeTDf+qv1/JdBF8gg5k9ZM=
+github.com/spf13/cobra v1.8.1/go.mod h1:wHxEcudfqmLYa8iTfL+OuZPbBZkmvliBWKIezN3kD9Y=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
@@ -126,6 +182,8 @@ github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavM
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
 golang.org/x/exp v0.0.0-20240604190554-fc45aab8b7f8 h1:LoYXNGAShUG3m/ehNk4iFctuhGX/+R1ZpfJ4/ia80JM=
 golang.org/x/exp v0.0.0-20240604190554-fc45aab8b7f8/go.mod h1:jj3sYF3dwk5D+ghuXyeI3r5MFf+NT2An6/9dOA95KSI=
+golang.org/x/exp v0.0.0-20240613232115-7f521ea00fb8 h1:yixxcjnhBmY0nkL253HFVIm0JsFHwrHdT3Yh6szTnfY=
+golang.org/x/exp v0.0.0-20240613232115-7f521ea00fb8/go.mod h1:jj3sYF3dwk5D+ghuXyeI3r5MFf+NT2An6/9dOA95KSI=
 golang.org/x/sys v0.0.0-20181122145206-62eef0e2fa9b/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20220310020820-b874c991c1a5/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
diff --git a/internal/aws/cfn/schemas/aws/apigateway/account.json b/internal/aws/cfn/schemas/aws/apigateway/account.json
index a4a7f826..3f654876 100644
--- a/internal/aws/cfn/schemas/aws/apigateway/account.json
+++ b/internal/aws/cfn/schemas/aws/apigateway/account.json
@@ -17,6 +17,9 @@
       }
     }
   },
+  "tagging": {
+    "taggable": false
+  },
   "primaryIdentifier": [
     "/properties/Id"
   ],
@@ -44,7 +47,9 @@
       ]
     },
     "delete": {
-      "permissions": []
+      "permissions": [
+        "apigateway:PATCH"
+      ]
     }
   }
 }
diff --git a/internal/aws/cfn/schemas/aws/apigateway/apikey.json b/internal/aws/cfn/schemas/aws/apigateway/apikey.json
index 77d15d47..f08379d8 100644
--- a/internal/aws/cfn/schemas/aws/apigateway/apikey.json
+++ b/internal/aws/cfn/schemas/aws/apigateway/apikey.json
@@ -89,6 +89,18 @@
       "description": ""
     }
   },
+  "tagging": {
+    "taggable": true,
+    "tagOnCreate": true,
+    "tagUpdatable": true,
+    "cloudFormationSystemTags": true,
+    "tagProperty": "/properties/Tags",
+    "permissions": [
+      "apigateway:PUT",
+      "apigateway:DELETE",
+      "apigateway:GET"
+    ]
+  },
   "createOnlyProperties": [
     "/properties/GenerateDistinctId",
     "/properties/Name",
diff --git a/internal/aws/cfn/schemas/aws/apigateway/clientcertificate.json b/internal/aws/cfn/schemas/aws/apigateway/clientcertificate.json
index b6bcaa17..48d785f4 100644
--- a/internal/aws/cfn/schemas/aws/apigateway/clientcertificate.json
+++ b/internal/aws/cfn/schemas/aws/apigateway/clientcertificate.json
@@ -40,6 +40,18 @@
       "description": ""
     }
   },
+  "tagging": {
+    "taggable": true,
+    "tagOnCreate": true,
+    "tagUpdatable": true,
+    "cloudFormationSystemTags": true,
+    "tagProperty": "/properties/Tags",
+    "permissions": [
+      "apigateway:PUT",
+      "apigateway:DELETE",
+      "apigateway:GET"
+    ]
+  },
   "primaryIdentifier": [
     "/properties/ClientCertificateId"
   ],
diff --git a/internal/aws/cfn/schemas/aws/apigateway/deployment.json b/internal/aws/cfn/schemas/aws/apigateway/deployment.json
index 218ffdd7..3f904608 100644
--- a/internal/aws/cfn/schemas/aws/apigateway/deployment.json
+++ b/internal/aws/cfn/schemas/aws/apigateway/deployment.json
@@ -265,7 +265,9 @@
       "description": "The ``MethodSetting`` property type configures settings for all methods in a stage.\n The ``MethodSettings`` property of the [Amazon API Gateway Deployment StageDescription](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-apigateway-deployment-stagedescription.html) property type contains a list of ``MethodSetting`` property types."
     }
   },
-  "taggable": true,
+  "tagging": {
+    "taggable": false
+  },
   "required": [
     "RestApiId"
   ],
diff --git a/internal/aws/cfn/schemas/aws/apigateway/documentationpart.json b/internal/aws/cfn/schemas/aws/apigateway/documentationpart.json
index c04b24b5..574d4dfc 100644
--- a/internal/aws/cfn/schemas/aws/apigateway/documentationpart.json
+++ b/internal/aws/cfn/schemas/aws/apigateway/documentationpart.json
@@ -73,6 +73,9 @@
     "/properties/Location",
     "/properties/RestApiId"
   ],
+  "tagging": {
+    "taggable": false
+  },
   "primaryIdentifier": [
     "/properties/DocumentationPartId",
     "/properties/RestApiId"
diff --git a/internal/aws/cfn/schemas/aws/apigateway/documentationversion.json b/internal/aws/cfn/schemas/aws/apigateway/documentationversion.json
index da8da031..2a7b8f1c 100644
--- a/internal/aws/cfn/schemas/aws/apigateway/documentationversion.json
+++ b/internal/aws/cfn/schemas/aws/apigateway/documentationversion.json
@@ -28,6 +28,9 @@
     "/properties/DocumentationVersion",
     "/properties/RestApiId"
   ],
+  "tagging": {
+    "taggable": false
+  },
   "primaryIdentifier": [
     "/properties/DocumentationVersion",
     "/properties/RestApiId"
diff --git a/internal/aws/cfn/schemas/aws/apigateway/gatewayresponse.json b/internal/aws/cfn/schemas/aws/apigateway/gatewayresponse.json
index c28ad180..65f904e0 100644
--- a/internal/aws/cfn/schemas/aws/apigateway/gatewayresponse.json
+++ b/internal/aws/cfn/schemas/aws/apigateway/gatewayresponse.json
@@ -55,7 +55,9 @@
   "readOnlyProperties": [
     "/properties/Id"
   ],
-  "taggable": false,
+  "tagging": {
+    "taggable": false
+  },
   "handlers": {
     "create": {
       "permissions": [
@@ -63,6 +65,11 @@
         "apigateway:GET"
       ]
     },
+    "read": {
+      "permissions": [
+        "apigateway:GET"
+      ]
+    },
     "update": {
       "permissions": [
         "apigateway:GET",
@@ -76,6 +83,16 @@
       ]
     },
     "list": {
+      "handlerSchema": {
+        "properties": {
+          "RestApiId": {
+            "$ref": "resource-schema.json#/properties/RestApiId"
+          }
+        },
+        "required": [
+          "RestApiId"
+        ]
+      },
       "permissions": [
         "apigateway:GET"
       ]
diff --git a/internal/aws/cfn/schemas/aws/apigateway/method.json b/internal/aws/cfn/schemas/aws/apigateway/method.json
index 162ec421..08d21201 100644
--- a/internal/aws/cfn/schemas/aws/apigateway/method.json
+++ b/internal/aws/cfn/schemas/aws/apigateway/method.json
@@ -208,13 +208,7 @@
     },
     "AuthorizationType": {
       "description": "The method's authorization type. This parameter is required. For valid values, see [Method](https://docs.aws.amazon.com/apigateway/latest/api/API_Method.html) in the *API Gateway API Reference*.\n  If you specify the ``AuthorizerId`` property, specify ``CUSTOM`` or ``COGNITO_USER_POOLS`` for this property.",
-      "type": "string",
-      "enum": [
-        "NONE",
-        "AWS_IAM",
-        "CUSTOM",
-        "COGNITO_USER_POOLS"
-      ]
+      "type": "string"
     },
     "AuthorizerId": {
       "description": "The identifier of an authorizer to use on this method. The method's authorization type must be ``CUSTOM`` or ``COGNITO_USER_POOLS``.",
@@ -273,7 +267,11 @@
     },
     "RestApiId": {
       "description": "The string identifier of the associated RestApi.",
-      "type": "string"
+      "type": "string",
+      "relationshipRef": {
+        "typeName": "AWS::ApiGateway::RestApi",
+        "propertyPath": "/properties/RestApiId"
+      }
     }
   },
   "additionalProperties": false,
diff --git a/internal/aws/cfn/schemas/aws/apigateway/model.json b/internal/aws/cfn/schemas/aws/apigateway/model.json
index a241d1da..95b7ed3f 100644
--- a/internal/aws/cfn/schemas/aws/apigateway/model.json
+++ b/internal/aws/cfn/schemas/aws/apigateway/model.json
@@ -31,6 +31,9 @@
   "required": [
     "RestApiId"
   ],
+  "tagging": {
+    "taggable": false
+  },
   "createOnlyProperties": [
     "/properties/ContentType",
     "/properties/Name",
diff --git a/internal/aws/cfn/schemas/aws/apigateway/requestvalidator.json b/internal/aws/cfn/schemas/aws/apigateway/requestvalidator.json
index 27e5b0ee..54548f88 100644
--- a/internal/aws/cfn/schemas/aws/apigateway/requestvalidator.json
+++ b/internal/aws/cfn/schemas/aws/apigateway/requestvalidator.json
@@ -35,6 +35,9 @@
   "readOnlyProperties": [
     "/properties/RequestValidatorId"
   ],
+  "tagging": {
+    "taggable": false
+  },
   "primaryIdentifier": [
     "/properties/RestApiId",
     "/properties/RequestValidatorId"
diff --git a/internal/aws/cfn/schemas/aws/apigateway/resource.json b/internal/aws/cfn/schemas/aws/apigateway/resource.json
index c6190d6e..0cfd41dd 100644
--- a/internal/aws/cfn/schemas/aws/apigateway/resource.json
+++ b/internal/aws/cfn/schemas/aws/apigateway/resource.json
@@ -29,12 +29,14 @@
       "type": "string"
     }
   },
-  "taggable": false,
   "required": [
     "ParentId",
     "PathPart",
     "RestApiId"
   ],
+  "tagging": {
+    "taggable": false
+  },
   "createOnlyProperties": [
     "/properties/PathPart",
     "/properties/ParentId",
diff --git a/internal/aws/cfn/schemas/aws/apigateway/restapi.json b/internal/aws/cfn/schemas/aws/apigateway/restapi.json
index 3dee98b3..b9bf5813 100644
--- a/internal/aws/cfn/schemas/aws/apigateway/restapi.json
+++ b/internal/aws/cfn/schemas/aws/apigateway/restapi.json
@@ -1,237 +1,242 @@
 {
+  "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-rpdk.git",
+  "tagging": {
+    "permissions": [
+      "apigateway:PUT",
+      "apigateway:DELETE",
+      "apigateway:GET"
+    ],
+    "taggable": true,
+    "tagOnCreate": true,
+    "tagUpdatable": true,
+    "tagProperty": "/properties/Tags",
+    "cloudFormationSystemTags": true
+  },
+  "handlers": {
+    "read": {
+      "permissions": [
+        "apigateway:GET"
+      ]
+    },
+    "create": {
+      "permissions": [
+        "apigateway:GET",
+        "apigateway:POST",
+        "apigateway:PUT",
+        "apigateway:PATCH",
+        "apigateway:UpdateRestApiPolicy",
+        "s3:GetObject",
+        "iam:PassRole"
+      ]
+    },
+    "update": {
+      "permissions": [
+        "apigateway:GET",
+        "apigateway:DELETE",
+        "apigateway:PATCH",
+        "apigateway:PUT",
+        "apigateway:UpdateRestApiPolicy",
+        "s3:GetObject",
+        "iam:PassRole"
+      ]
+    },
+    "list": {
+      "permissions": [
+        "apigateway:GET"
+      ]
+    },
+    "delete": {
+      "permissions": [
+        "apigateway:DELETE"
+      ]
+    }
+  },
   "typeName": "AWS::ApiGateway::RestApi",
+  "readOnlyProperties": [
+    "/properties/RestApiId",
+    "/properties/RootResourceId"
+  ],
   "description": "The ``AWS::ApiGateway::RestApi`` resource creates a REST API. For more information, see [restapi:create](https://docs.aws.amazon.com/apigateway/latest/api/API_CreateRestApi.html) in the *Amazon API Gateway REST API Reference*.\n On January 1, 2016, the Swagger Specification was donated to the [OpenAPI initiative](https://docs.aws.amazon.com/https://www.openapis.org/), becoming the foundation of the OpenAPI Specification.",
-  "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-rpdk.git",
+  "writeOnlyProperties": [
+    "/properties/Body",
+    "/properties/BodyS3Location",
+    "/properties/CloneFrom",
+    "/properties/FailOnWarnings",
+    "/properties/Mode",
+    "/properties/Parameters"
+  ],
   "additionalProperties": false,
+  "primaryIdentifier": [
+    "/properties/RestApiId"
+  ],
   "definitions": {
     "EndpointConfiguration": {
-      "type": "object",
+      "description": "The ``EndpointConfiguration`` property type specifies the endpoint types of a REST API.\n ``EndpointConfiguration`` is a property of the [AWS::ApiGateway::RestApi](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigateway-restapi.html) resource.",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
         "Types": {
-          "type": "array",
           "uniqueItems": true,
+          "description": "A list of endpoint types of an API (RestApi) or its custom domain name (DomainName). For an edge-optimized API and its custom domain name, the endpoint type is ``\"EDGE\"``. For a regional API and its custom domain name, the endpoint type is ``REGIONAL``. For a private API, the endpoint type is ``PRIVATE``.",
+          "type": "array",
           "items": {
             "type": "string"
-          },
-          "description": "A list of endpoint types of an API (RestApi) or its custom domain name (DomainName). For an edge-optimized API and its custom domain name, the endpoint type is ``\"EDGE\"``. For a regional API and its custom domain name, the endpoint type is ``REGIONAL``. For a private API, the endpoint type is ``PRIVATE``."
+          }
         },
         "VpcEndpointIds": {
-          "type": "array",
           "uniqueItems": true,
+          "description": "A list of VpcEndpointIds of an API (RestApi) against which to create Route53 ALIASes. It is only supported for ``PRIVATE`` endpoint type.",
+          "type": "array",
           "items": {
-            "type": "string",
             "relationshipRef": {
               "typeName": "AWS::EC2::VPCEndpoint",
               "propertyPath": "/properties/Id"
-            }
-          },
-          "description": "A list of VpcEndpointIds of an API (RestApi) against which to create Route53 ALIASes. It is only supported for ``PRIVATE`` endpoint type."
+            },
+            "type": "string"
+          }
         }
-      },
-      "description": "The ``EndpointConfiguration`` property type specifies the endpoint types of a REST API.\n ``EndpointConfiguration`` is a property of the [AWS::ApiGateway::RestApi](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigateway-restapi.html) resource."
+      }
     },
     "Tag": {
-      "type": "object",
+      "description": "",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
-        "Key": {
+        "Value": {
           "type": "string"
         },
-        "Value": {
+        "Key": {
           "type": "string"
         }
       },
       "required": [
         "Key",
         "Value"
-      ],
-      "description": ""
+      ]
     },
     "S3Location": {
-      "type": "object",
+      "description": "``S3Location`` is a property of the [AWS::ApiGateway::RestApi](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigateway-restapi.html) resource that specifies the Amazon S3 location of a OpenAPI (formerly Swagger) file that defines a set of RESTful APIs in JSON or YAML.\n On January 1, 2016, the Swagger Specification was donated to the [OpenAPI initiative](https://docs.aws.amazon.com/https://www.openapis.org/), becoming the foundation of the OpenAPI Specification.",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
         "Bucket": {
-          "type": "string",
           "relationshipRef": {
             "typeName": "AWS::S3::Bucket",
             "propertyPath": "/properties/BucketName"
           },
-          "description": "The name of the S3 bucket where the OpenAPI file is stored."
+          "description": "The name of the S3 bucket where the OpenAPI file is stored.",
+          "type": "string"
         },
         "ETag": {
-          "type": "string",
-          "description": "The Amazon S3 ETag (a file checksum) of the OpenAPI file. If you don't specify a value, API Gateway skips ETag validation of your OpenAPI file."
+          "description": "The Amazon S3 ETag (a file checksum) of the OpenAPI file. If you don't specify a value, API Gateway skips ETag validation of your OpenAPI file.",
+          "type": "string"
         },
         "Version": {
-          "type": "string",
-          "description": "For versioning-enabled buckets, a specific version of the OpenAPI file."
+          "description": "For versioning-enabled buckets, a specific version of the OpenAPI file.",
+          "type": "string"
         },
         "Key": {
-          "type": "string",
-          "description": "The file name of the OpenAPI file (Amazon S3 object name)."
+          "description": "The file name of the OpenAPI file (Amazon S3 object name).",
+          "type": "string"
         }
-      },
-      "description": "``S3Location`` is a property of the [AWS::ApiGateway::RestApi](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigateway-restapi.html) resource that specifies the Amazon S3 location of a OpenAPI (formerly Swagger) file that defines a set of RESTful APIs in JSON or YAML.\n On January 1, 2016, the Swagger Specification was donated to the [OpenAPI initiative](https://docs.aws.amazon.com/https://www.openapis.org/), becoming the foundation of the OpenAPI Specification."
+      }
     }
   },
   "properties": {
-    "RestApiId": {
-      "type": "string",
-      "description": ""
+    "Policy": {
+      "description": "A policy document that contains the permissions for the ``RestApi`` resource. To set the ARN for the policy, use the ``!Join`` intrinsic function with ``\"\"`` as delimiter and values of ``\"execute-api:/\"`` and ``\"*\"``.",
+      "type": [
+        "object",
+        "string"
+      ]
     },
-    "RootResourceId": {
-      "type": "string",
-      "description": ""
+    "BodyS3Location": {
+      "description": "The Amazon Simple Storage Service (Amazon S3) location that points to an OpenAPI file, which defines a set of RESTful APIs in JSON or YAML format.",
+      "$ref": "#/definitions/S3Location"
     },
-    "ApiKeySourceType": {
-      "type": "string",
-      "description": "The source of the API key for metering requests according to a usage plan. Valid values are: ``HEADER`` to read the API key from the ``X-API-Key`` header of a request. ``AUTHORIZER`` to read the API key from the ``UsageIdentifierKey`` from a custom authorizer."
+    "Description": {
+      "description": "The description of the RestApi.",
+      "type": "string"
     },
-    "BinaryMediaTypes": {
-      "type": "array",
-      "uniqueItems": true,
-      "items": {
-        "type": "string"
-      },
-      "description": "The list of binary media types supported by the RestApi. By default, the RestApi supports only UTF-8-encoded text payloads."
+    "MinimumCompressionSize": {
+      "description": "A nullable integer that is used to enable compression (with non-negative between 0 and 10485760 (10M) bytes, inclusive) or disable compression (with a null value) on an API. When compression is enabled, compression or decompression is not applied on the payload if the payload size is smaller than this value. Setting it to zero allows compression for any payload size.",
+      "type": "integer"
     },
-    "Body": {
+    "Parameters": {
+      "patternProperties": {
+        "[a-zA-Z0-9]+": {
+          "type": "string"
+        }
+      },
+      "description": "Custom header parameters as part of the request. For example, to exclude DocumentationParts from an imported API, set ``ignore=documentation`` as a ``parameters`` value, as in the AWS CLI command of ``aws apigateway import-rest-api --parameters ignore=documentation --body 'file:///path/to/imported-api-body.json'``.",
+      "additionalProperties": false,
       "type": [
         "object",
         "string"
-      ],
-      "description": "An OpenAPI specification that defines a set of RESTful APIs in JSON format. For YAML templates, you can also provide the specification in YAML format."
-    },
-    "BodyS3Location": {
-      "$ref": "#/definitions/S3Location",
-      "description": "The Amazon Simple Storage Service (Amazon S3) location that points to an OpenAPI file, which defines a set of RESTful APIs in JSON or YAML format."
+      ]
     },
     "CloneFrom": {
-      "type": "string",
       "relationshipRef": {
         "typeName": "AWS::ApiGateway::RestApi",
         "propertyPath": "/properties/RestApiId"
       },
-      "description": "The ID of the RestApi that you want to clone from."
+      "description": "The ID of the RestApi that you want to clone from.",
+      "type": "string"
     },
-    "EndpointConfiguration": {
-      "$ref": "#/definitions/EndpointConfiguration",
-      "description": "A list of the endpoint types of the API. Use this property when creating an API. When importing an existing API, specify the endpoint configuration types using the ``Parameters`` property."
+    "Mode": {
+      "description": "This property applies only when you use OpenAPI to define your REST API. The ``Mode`` determines how API Gateway handles resource updates.\n Valid values are ``overwrite`` or ``merge``. \n For ``overwrite``, the new API definition replaces the existing one. The existing API identifier remains unchanged.\n  For ``merge``, the new API definition is merged with the existing API.\n If you don't specify this property, a default value is chosen. For REST APIs created before March 29, 2021, the default is ``overwrite``. For REST APIs created after March 29, 2021, the new API definition takes precedence, but any container types such as endpoint configurations and binary media types are merged with the existing API. \n Use the default mode to define top-level ``RestApi`` properties in addition to using OpenAPI. Generally, it's preferred to use API Gateway's OpenAPI extensions to model these properties.",
+      "type": "string"
     },
-    "Description": {
-      "type": "string",
-      "description": "The description of the RestApi."
+    "RestApiId": {
+      "description": "",
+      "type": "string"
     },
     "DisableExecuteApiEndpoint": {
-      "type": "boolean",
-      "description": "Specifies whether clients can invoke your API by using the default ``execute-api`` endpoint. By default, clients can invoke your API with the default ``https://{api_id}.execute-api.{region}.amazonaws.com`` endpoint. To require that clients use a custom domain name to invoke your API, disable the default endpoint"
+      "description": "Specifies whether clients can invoke your API by using the default ``execute-api`` endpoint. By default, clients can invoke your API with the default ``https://{api_id}.execute-api.{region}.amazonaws.com`` endpoint. To require that clients use a custom domain name to invoke your API, disable the default endpoint",
+      "type": "boolean"
     },
     "FailOnWarnings": {
-      "type": "boolean",
-      "description": "A query parameter to indicate whether to rollback the API update (``true``) or not (``false``) when a warning is encountered. The default value is ``false``."
+      "description": "A query parameter to indicate whether to rollback the API update (``true``) or not (``false``) when a warning is encountered. The default value is ``false``.",
+      "type": "boolean"
+    },
+    "BinaryMediaTypes": {
+      "uniqueItems": true,
+      "description": "The list of binary media types supported by the RestApi. By default, the RestApi supports only UTF-8-encoded text payloads.",
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
     },
     "Name": {
-      "type": "string",
-      "description": "The name of the RestApi. A name is required if the REST API is not based on an OpenAPI specification."
+      "description": "The name of the RestApi. A name is required if the REST API is not based on an OpenAPI specification.",
+      "type": "string"
     },
-    "MinimumCompressionSize": {
-      "type": "integer",
-      "description": "A nullable integer that is used to enable compression (with non-negative between 0 and 10485760 (10M) bytes, inclusive) or disable compression (with a null value) on an API. When compression is enabled, compression or decompression is not applied on the payload if the payload size is smaller than this value. Setting it to zero allows compression for any payload size."
+    "RootResourceId": {
+      "description": "",
+      "type": "string"
     },
-    "Mode": {
-      "type": "string",
-      "description": "This property applies only when you use OpenAPI to define your REST API. The ``Mode`` determines how API Gateway handles resource updates.\n Valid values are ``overwrite`` or ``merge``. \n For ``overwrite``, the new API definition replaces the existing one. The existing API identifier remains unchanged.\n  For ``merge``, the new API definition is merged with the existing API.\n If you don't specify this property, a default value is chosen. For REST APIs created before March 29, 2021, the default is ``overwrite``. For REST APIs created after March 29, 2021, the new API definition takes precedence, but any container types such as endpoint configurations and binary media types are merged with the existing API. \n Use the default mode to define top-level ``RestApi`` properties in addition to using OpenAPI. Generally, it's preferred to use API Gateway's OpenAPI extensions to model these properties."
+    "ApiKeySourceType": {
+      "description": "The source of the API key for metering requests according to a usage plan. Valid values are: ``HEADER`` to read the API key from the ``X-API-Key`` header of a request. ``AUTHORIZER`` to read the API key from the ``UsageIdentifierKey`` from a custom authorizer.",
+      "type": "string"
     },
-    "Policy": {
-      "type": [
-        "object",
-        "string"
-      ],
-      "description": "A policy document that contains the permissions for the ``RestApi`` resource. To set the ARN for the policy, use the ``!Join`` intrinsic function with ``\"\"`` as delimiter and values of ``\"execute-api:/\"`` and ``\"*\"``."
+    "EndpointConfiguration": {
+      "description": "A list of the endpoint types of the API. Use this property when creating an API. When importing an existing API, specify the endpoint configuration types using the ``Parameters`` property.",
+      "$ref": "#/definitions/EndpointConfiguration"
     },
-    "Parameters": {
+    "Body": {
+      "description": "An OpenAPI specification that defines a set of RESTful APIs in JSON format. For YAML templates, you can also provide the specification in YAML format.",
       "type": [
         "object",
         "string"
-      ],
-      "additionalProperties": false,
-      "patternProperties": {
-        "[a-zA-Z0-9]+": {
-          "type": "string"
-        }
-      },
-      "description": "Custom header parameters as part of the request. For example, to exclude DocumentationParts from an imported API, set ``ignore=documentation`` as a ``parameters`` value, as in the AWS CLI command of ``aws apigateway import-rest-api --parameters ignore=documentation --body 'file:///path/to/imported-api-body.json'``."
+      ]
     },
     "Tags": {
-      "type": "array",
       "uniqueItems": false,
+      "description": "The key-value map of strings. The valid character set is [a-zA-Z+-=._:/]. The tag key can be up to 128 characters and must not start with ``aws:``. The tag value can be up to 256 characters.",
+      "type": "array",
       "items": {
         "$ref": "#/definitions/Tag"
-      },
-      "description": "The key-value map of strings. The valid character set is [a-zA-Z+-=._:/]. The tag key can be up to 128 characters and must not start with ``aws:``. The tag value can be up to 256 characters."
-    }
-  },
-  "tagging": {
-    "taggable": true,
-    "tagOnCreate": true,
-    "tagUpdatable": true,
-    "cloudFormationSystemTags": true,
-    "tagProperty": "/properties/Tags"
-  },
-  "primaryIdentifier": [
-    "/properties/RestApiId"
-  ],
-  "readOnlyProperties": [
-    "/properties/RestApiId",
-    "/properties/RootResourceId"
-  ],
-  "writeOnlyProperties": [
-    "/properties/Body",
-    "/properties/BodyS3Location",
-    "/properties/CloneFrom",
-    "/properties/FailOnWarnings",
-    "/properties/Mode",
-    "/properties/Parameters"
-  ],
-  "handlers": {
-    "create": {
-      "permissions": [
-        "apigateway:GET",
-        "apigateway:POST",
-        "apigateway:PUT",
-        "apigateway:PATCH",
-        "apigateway:UpdateRestApiPolicy",
-        "s3:GetObject",
-        "iam:PassRole"
-      ]
-    },
-    "read": {
-      "permissions": [
-        "apigateway:GET"
-      ]
-    },
-    "update": {
-      "permissions": [
-        "apigateway:GET",
-        "apigateway:DELETE",
-        "apigateway:PATCH",
-        "apigateway:PUT",
-        "apigateway:UpdateRestApiPolicy",
-        "s3:GetObject",
-        "iam:PassRole"
-      ]
-    },
-    "delete": {
-      "permissions": [
-        "apigateway:DELETE"
-      ]
-    },
-    "list": {
-      "permissions": [
-        "apigateway:GET"
-      ]
+      }
     }
   }
 }
diff --git a/internal/aws/cfn/schemas/aws/apigateway/stage.json b/internal/aws/cfn/schemas/aws/apigateway/stage.json
index 02dc1fe7..0fee84e1 100644
--- a/internal/aws/cfn/schemas/aws/apigateway/stage.json
+++ b/internal/aws/cfn/schemas/aws/apigateway/stage.json
@@ -213,7 +213,12 @@
     "tagOnCreate": true,
     "tagUpdatable": true,
     "cloudFormationSystemTags": true,
-    "tagProperty": "/properties/Tags"
+    "tagProperty": "/properties/Tags",
+    "permissions": [
+      "apigateway:PUT",
+      "apigateway:DELETE",
+      "apigateway:GET"
+    ]
   },
   "handlers": {
     "create": {
diff --git a/internal/aws/cfn/schemas/aws/apigateway/usageplan.json b/internal/aws/cfn/schemas/aws/apigateway/usageplan.json
index 876619d3..4d1931f0 100644
--- a/internal/aws/cfn/schemas/aws/apigateway/usageplan.json
+++ b/internal/aws/cfn/schemas/aws/apigateway/usageplan.json
@@ -135,7 +135,12 @@
     "tagOnCreate": true,
     "tagUpdatable": true,
     "cloudFormationSystemTags": true,
-    "tagProperty": "/properties/Tags"
+    "tagProperty": "/properties/Tags",
+    "permissions": [
+      "apigateway:PUT",
+      "apigateway:DELETE",
+      "apigateway:GET"
+    ]
   },
   "primaryIdentifier": [
     "/properties/Id"
diff --git a/internal/aws/cfn/schemas/aws/apigateway/usageplankey.json b/internal/aws/cfn/schemas/aws/apigateway/usageplankey.json
index 499c99f0..2d373909 100644
--- a/internal/aws/cfn/schemas/aws/apigateway/usageplankey.json
+++ b/internal/aws/cfn/schemas/aws/apigateway/usageplankey.json
@@ -24,7 +24,9 @@
       "type": "string"
     }
   },
-  "taggable": false,
+  "tagging": {
+    "taggable": false
+  },
   "required": [
     "KeyType",
     "UsagePlanId",
diff --git a/internal/aws/cfn/schemas/aws/apigateway/vpclink.json b/internal/aws/cfn/schemas/aws/apigateway/vpclink.json
index 3e09a90b..d20f73b0 100644
--- a/internal/aws/cfn/schemas/aws/apigateway/vpclink.json
+++ b/internal/aws/cfn/schemas/aws/apigateway/vpclink.json
@@ -1,18 +1,18 @@
 {
   "typeName": "AWS::ApiGateway::VpcLink",
-  "description": "Schema for AWS ApiGateway VpcLink",
+  "description": "The ``AWS::ApiGateway::VpcLink`` resource creates an API Gateway VPC link for a REST API to access resources in an Amazon Virtual Private Cloud (VPC). For more information, see [vpclink:create](https://docs.aws.amazon.com/apigateway/latest/api/API_CreateVpcLink.html) in the ``Amazon API Gateway REST API Reference``.",
   "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-rpdk.git",
   "properties": {
     "Name": {
-      "description": "A name for the VPC link.",
+      "description": "The name used to label and identify the VPC link.",
       "type": "string"
     },
     "Description": {
-      "description": "A description of the VPC link.",
+      "description": "The description of the VPC link.",
       "type": "string"
     },
     "Tags": {
-      "description": "An array of arbitrary tags (key-value pairs) to associate with the stage.",
+      "description": "An array of arbitrary tags (key-value pairs) to associate with the VPC link.",
       "insertionOrder": false,
       "uniqueItems": true,
       "type": "array",
@@ -21,7 +21,7 @@
       }
     },
     "TargetArns": {
-      "description": "The ARN of network load balancer of the VPC targeted by the VPC link. The network load balancer must be owned by the same AWS account of the API owner.",
+      "description": "The ARN of the network load balancer of the VPC targeted by the VPC link. The network load balancer must be owned by the same AWS-account of the API owner.",
       "type": "array",
       "uniqueItems": false,
       "insertionOrder": false,
@@ -30,7 +30,7 @@
       }
     },
     "VpcLinkId": {
-      "description": "The ID of the instance that backs VPC link.",
+      "description": "",
       "type": "string"
     }
   },
@@ -49,7 +49,8 @@
       "required": [
         "Value",
         "Key"
-      ]
+      ],
+      "description": ""
     }
   },
   "required": [
diff --git a/internal/aws/cfn/schemas/aws/applicationsignals/servicelevelobjective.json b/internal/aws/cfn/schemas/aws/applicationsignals/servicelevelobjective.json
new file mode 100644
index 00000000..77ccf63f
--- /dev/null
+++ b/internal/aws/cfn/schemas/aws/applicationsignals/servicelevelobjective.json
@@ -0,0 +1,414 @@
+{
+  "typeName": "AWS::ApplicationSignals::ServiceLevelObjective",
+  "description": "Resource Type definition for AWS::ApplicationSignals::ServiceLevelObjective",
+  "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-applicationsignals",
+  "additionalProperties": false,
+  "properties": {
+    "Arn": {
+      "description": "The ARN of this SLO.",
+      "type": "string",
+      "pattern": "^arn:[^:]*:application-signals:[^:]*:[^:]*:slo\\/[0-9A-Za-z][-._0-9A-Za-z ]{0,126}[0-9A-Za-z]$"
+    },
+    "Name": {
+      "description": "The name of this SLO.",
+      "type": "string",
+      "pattern": "^[0-9A-Za-z][-._0-9A-Za-z ]{0,126}[0-9A-Za-z]$"
+    },
+    "Description": {
+      "description": "An optional description for this SLO. Default is 'No description'",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 1024,
+      "default": "No description"
+    },
+    "CreatedTime": {
+      "type": "integer",
+      "description": "Epoch time in seconds of the time that this SLO was created",
+      "minimum": 946684800
+    },
+    "LastUpdatedTime": {
+      "type": "integer",
+      "description": "Epoch time in seconds of the time that this SLO was most recently updated",
+      "minimum": 946684800
+    },
+    "Sli": {
+      "$ref": "#/definitions/Sli"
+    },
+    "Goal": {
+      "$ref": "#/definitions/Goal"
+    },
+    "Tags": {
+      "$ref": "#/definitions/Tags"
+    }
+  },
+  "required": [
+    "Name",
+    "Sli"
+  ],
+  "readOnlyProperties": [
+    "/properties/Arn",
+    "/properties/CreatedTime",
+    "/properties/LastUpdatedTime"
+  ],
+  "primaryIdentifier": [
+    "/properties/Arn"
+  ],
+  "createOnlyProperties": [
+    "/properties/Name"
+  ],
+  "definitions": {
+    "Sli": {
+      "description": "This structure contains information about the performance metric that an SLO monitors.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "SliMetric": {
+          "$ref": "#/definitions/SliMetric"
+        },
+        "MetricThreshold": {
+          "description": "The value that the SLI metric is compared to.",
+          "type": "number"
+        },
+        "ComparisonOperator": {
+          "description": "The arithmetic operation used when comparing the specified metric to the threshold.",
+          "type": "string",
+          "enum": [
+            "GreaterThanOrEqualTo",
+            "LessThanOrEqualTo",
+            "LessThan",
+            "GreaterThan"
+          ]
+        }
+      },
+      "required": [
+        "SliMetric",
+        "MetricThreshold",
+        "ComparisonOperator"
+      ]
+    },
+    "Goal": {
+      "description": "A structure that contains the attributes that determine the goal of the SLO. This includes the time period for evaluation and the attainment threshold.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "Interval": {
+          "$ref": "#/definitions/Interval"
+        },
+        "AttainmentGoal": {
+          "description": "The threshold that determines if the goal is being met. An attainment goal is the ratio of good periods that meet the threshold requirements to the total periods within the interval. For example, an attainment goal of 99.9% means that within your interval, you are targeting 99.9% of the periods to be in healthy state.\nIf you omit this parameter, 99 is used to represent 99% as the attainment goal.",
+          "type": "number"
+        },
+        "WarningThreshold": {
+          "description": "The percentage of remaining budget over total budget that you want to get warnings for. If you omit this parameter, the default of 50.0 is used.",
+          "type": "number"
+        }
+      }
+    },
+    "SliMetric": {
+      "description": "A structure that contains information about the metric that the SLO monitors.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "KeyAttributes": {
+          "$ref": "#/definitions/KeyAttributes"
+        },
+        "OperationName": {
+          "description": "If the SLO monitors a specific operation of the service, this field displays that operation name.",
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 255
+        },
+        "MetricType": {
+          "description": "If the SLO monitors either the LATENCY or AVAILABILITY metric that Application Signals collects, this field displays which of those metrics is used.",
+          "type": "string",
+          "enum": [
+            "LATENCY",
+            "AVAILABILITY"
+          ]
+        },
+        "Statistic": {
+          "description": "The statistic to use for comparison to the threshold. It can be any CloudWatch statistic or extended statistic",
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 20
+        },
+        "PeriodSeconds": {
+          "description": "The number of seconds to use as the period for SLO evaluation. Your application's performance is compared to the SLI during each period. For each period, the application is determined to have either achieved or not achieved the necessary performance.",
+          "type": "integer",
+          "minimum": 60,
+          "maximum": 900
+        },
+        "MetricDataQueries": {
+          "$ref": "#/definitions/MetricDataQueries"
+        }
+      }
+    },
+    "KeyAttributes": {
+      "description": "This is a string-to-string map that contains information about the type of object that this SLO is related to.",
+      "patternProperties": {
+        "^.+$": {
+          "type": "string"
+        }
+      },
+      "additionalProperties": false
+    },
+    "Interval": {
+      "description": "The time period used to evaluate the SLO. It can be either a calendar interval or rolling interval.\nIf you omit this parameter, a rolling interval of 7 days is used.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "RollingInterval": {
+          "$ref": "#/definitions/RollingInterval"
+        },
+        "CalendarInterval": {
+          "$ref": "#/definitions/CalendarInterval"
+        }
+      }
+    },
+    "RollingInterval": {
+      "description": "If the interval is a calendar interval, this structure contains the interval specifications.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "DurationUnit": {
+          "$ref": "#/definitions/DurationUnit"
+        },
+        "Duration": {
+          "$ref": "#/definitions/Duration"
+        }
+      },
+      "required": [
+        "DurationUnit",
+        "Duration"
+      ]
+    },
+    "CalendarInterval": {
+      "description": "If the interval for this service level objective is a calendar interval, this structure contains the interval specifications.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "StartTime": {
+          "type": "integer",
+          "description": "Epoch time in seconds you want the first interval to start. Be sure to choose a time that configures the intervals the way that you want. For example, if you want weekly intervals starting on Mondays at 6 a.m., be sure to specify a start time that is a Monday at 6 a.m.\nAs soon as one calendar interval ends, another automatically begins.",
+          "minimum": 946684800
+        },
+        "DurationUnit": {
+          "$ref": "#/definitions/DurationUnit"
+        },
+        "Duration": {
+          "$ref": "#/definitions/Duration"
+        }
+      },
+      "required": [
+        "StartTime",
+        "DurationUnit",
+        "Duration"
+      ]
+    },
+    "DurationUnit": {
+      "description": "Specifies the calendar interval unit.",
+      "type": "string",
+      "enum": [
+        "DAY",
+        "MONTH"
+      ]
+    },
+    "Duration": {
+      "description": "Specifies the duration of each calendar interval. For example, if `Duration` is 1 and `DurationUnit` is `MONTH`, each interval is one month, aligned with the calendar.",
+      "type": "integer",
+      "minimum": 1
+    },
+    "MetricDataQueries": {
+      "description": "If this SLO monitors a CloudWatch metric or the result of a CloudWatch metric math expression, this structure includes the information about that metric or expression.",
+      "type": "array",
+      "uniqueItems": false,
+      "insertionOrder": true,
+      "items": {
+        "$ref": "#/definitions/MetricDataQuery"
+      }
+    },
+    "MetricDataQuery": {
+      "description": "Use this structure to define a metric or metric math expression that you want to use as for a service level objective.\nEach `MetricDataQuery` in the `MetricDataQueries` array specifies either a metric to retrieve, or a metric math expression to be performed on retrieved metrics. A single `MetricDataQueries` array can include as many as 20 `MetricDataQuery` structures in the array. The 20 structures can include as many as 10 structures that contain a `MetricStat` parameter to retrieve a metric, and as many as 10 structures that contain the `Expression` parameter to perform a math expression. Of those Expression structures, exactly one must have true as the value for `ReturnData`. The result of this expression used for the SLO.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "MetricStat": {
+          "description": "A metric to be used directly for the SLO, or to be used in the math expression that will be used for the SLO. Within one MetricDataQuery, you must specify either Expression or MetricStat but not both.",
+          "$ref": "#/definitions/MetricStat"
+        },
+        "Id": {
+          "description": "A short name used to tie this object to the results in the response.",
+          "type": "string"
+        },
+        "ReturnData": {
+          "description": "This option indicates whether to return the timestamps and raw data values of this metric.",
+          "type": "boolean"
+        },
+        "Expression": {
+          "description": "The math expression to be performed on the returned data.",
+          "type": "string"
+        },
+        "AccountId": {
+          "description": "The ID of the account where the metrics are located, if this is a cross-account alarm.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "Id"
+      ]
+    },
+    "MetricStat": {
+      "description": "A metric to be used directly for the SLO, or to be used in the math expression that will be used for the SLO. Within one MetricDataQuery object, you must specify either Expression or MetricStat but not both.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "Period": {
+          "description": "The granularity, in seconds, to be used for the metric.",
+          "type": "integer"
+        },
+        "Metric": {
+          "$ref": "#/definitions/Metric"
+        },
+        "Stat": {
+          "description": "The statistic to use for comparison to the threshold. It can be any CloudWatch statistic or extended statistic.",
+          "type": "string"
+        },
+        "Unit": {
+          "description": "If you omit Unit then all data that was collected with any unit is returned, along with the corresponding units that were specified when the data was reported to CloudWatch. If you specify a unit, the operation returns only data that was collected with that unit specified. If you specify a unit that does not match the data collected, the results of the operation are null. CloudWatch does not perform unit conversions.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "Stat",
+        "Period",
+        "Metric"
+      ]
+    },
+    "Metric": {
+      "description": "This structure defines the metric used for a service level indicator, including the metric name, namespace, and dimensions.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "MetricName": {
+          "description": "The name of the metric to use.",
+          "type": "string"
+        },
+        "Dimensions": {
+          "description": "An array of one or more dimensions to use to define the metric that you want to use.",
+          "type": "array",
+          "uniqueItems": false,
+          "insertionOrder": false,
+          "items": {
+            "$ref": "#/definitions/Dimension"
+          }
+        },
+        "Namespace": {
+          "description": "The namespace of the metric.",
+          "type": "string"
+        }
+      }
+    },
+    "Dimension": {
+      "description": "A dimension is a name/value pair that is part of the identity of a metric. Because dimensions are part of the unique identifier for a metric, whenever you add a unique name/value pair to one of your metrics, you are creating a new variation of that metric. For example, many Amazon EC2 metrics publish `InstanceId` as a dimension name, and the actual instance ID as the value for that dimension. You can assign up to 30 dimensions to a metric.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "Value": {
+          "description": "The value of the dimension. Dimension values must contain only ASCII characters and must include at least one non-whitespace character. ASCII control characters are not supported as part of dimension values",
+          "type": "string"
+        },
+        "Name": {
+          "description": "The name of the dimension. Dimension names must contain only ASCII characters, must include at least one non-whitespace character, and cannot start with a colon (:). ASCII control characters are not supported as part of dimension names.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "Value",
+        "Name"
+      ]
+    },
+    "Tags": {
+      "description": "The list of tag keys and values associated with the resource you specified",
+      "type": "array",
+      "uniqueItems": true,
+      "insertionOrder": false,
+      "items": {
+        "$ref": "#/definitions/Tag"
+      },
+      "minItems": 1,
+      "maxItems": 200
+    },
+    "Tag": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "Key": {
+          "type": "string",
+          "pattern": "^(?!aws:)[a-zA-Z+-=._:/]+$",
+          "description": "A string that you can use to assign a value. The combination of tag keys and values can help you organize and categorize your resources.",
+          "minLength": 1,
+          "maxLength": 128
+        },
+        "Value": {
+          "type": "string",
+          "description": "The value for the specified tag key.",
+          "minLength": 0,
+          "maxLength": 256
+        }
+      },
+      "required": [
+        "Key",
+        "Value"
+      ]
+    }
+  },
+  "handlers": {
+    "create": {
+      "permissions": [
+        "application-signals:CreateServiceLevelObjective",
+        "cloudwatch:GetMetricData",
+        "application-signals:TagResource",
+        "application-signals:GetServiceLevelObjective",
+        "application-signals:ListTagsForResource",
+        "iam:GetRole",
+        "iam:CreateServiceLinkedRole"
+      ]
+    },
+    "read": {
+      "permissions": [
+        "application-signals:GetServiceLevelObjective",
+        "application-signals:ListTagsForResource"
+      ]
+    },
+    "update": {
+      "permissions": [
+        "application-signals:UpdateServiceLevelObjective",
+        "cloudwatch:GetMetricData",
+        "application-signals:TagResource",
+        "application-signals:UntagResource",
+        "application-signals:GetServiceLevelObjective",
+        "application-signals:ListTagsForResource"
+      ]
+    },
+    "delete": {
+      "permissions": [
+        "application-signals:DeleteServiceLevelObjective",
+        "application-signals:UntagResource",
+        "application-signals:GetServiceLevelObjective"
+      ]
+    },
+    "list": {
+      "permissions": [
+        "application-signals:ListServiceLevelObjectives",
+        "application-signals:ListTagsForResource"
+      ]
+    }
+  },
+  "tagging": {
+    "taggable": true,
+    "tagOnCreate": true,
+    "tagUpdatable": true,
+    "cloudFormationSystemTags": true,
+    "tagProperty": "/properties/Tags"
+  }
+}
diff --git a/internal/aws/cfn/schemas/aws/appsync/sourceapiassociation.json b/internal/aws/cfn/schemas/aws/appsync/sourceapiassociation.json
index 582b2780..4cd18539 100644
--- a/internal/aws/cfn/schemas/aws/appsync/sourceapiassociation.json
+++ b/internal/aws/cfn/schemas/aws/appsync/sourceapiassociation.json
@@ -4,7 +4,6 @@
   "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-appsync",
   "definitions": {
     "SourceApiAssociationConfig": {
-      "type": "object",
       "properties": {
         "MergeType": {
           "description": "Configuration of the merged behavior for the association. For example when it could be auto or has to be manual.",
diff --git a/internal/aws/cfn/schemas/aws/apptest/testcase.json b/internal/aws/cfn/schemas/aws/apptest/testcase.json
new file mode 100644
index 00000000..26e48d24
--- /dev/null
+++ b/internal/aws/cfn/schemas/aws/apptest/testcase.json
@@ -0,0 +1,713 @@
+{
+  "typeName": "AWS::AppTest::TestCase",
+  "description": "Represents a Test Case that can be captured and executed",
+  "definitions": {
+    "Batch": {
+      "type": "object",
+      "properties": {
+        "BatchJobName": {
+          "type": "string",
+          "pattern": "^\\S{1,1000}$"
+        },
+        "BatchJobParameters": {
+          "$ref": "#/definitions/BatchJobParameters"
+        },
+        "ExportDataSetNames": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "pattern": "^\\S{1,100}$"
+          }
+        }
+      },
+      "required": [
+        "BatchJobName"
+      ],
+      "additionalProperties": false
+    },
+    "BatchJobParameters": {
+      "type": "object",
+      "patternProperties": {
+        ".+": {
+          "type": "string"
+        }
+      },
+      "additionalProperties": false
+    },
+    "CaptureTool": {
+      "type": "string",
+      "enum": [
+        "Precisely",
+        "AWS DMS"
+      ]
+    },
+    "CloudFormationAction": {
+      "type": "object",
+      "properties": {
+        "Resource": {
+          "type": "string",
+          "pattern": "^\\S{1,1000}$"
+        },
+        "ActionType": {
+          "$ref": "#/definitions/CloudFormationActionType"
+        }
+      },
+      "required": [
+        "Resource"
+      ],
+      "additionalProperties": false
+    },
+    "CloudFormationActionType": {
+      "type": "string",
+      "enum": [
+        "Create",
+        "Delete"
+      ]
+    },
+    "CompareAction": {
+      "type": "object",
+      "properties": {
+        "Input": {
+          "$ref": "#/definitions/Input"
+        },
+        "Output": {
+          "$ref": "#/definitions/Output"
+        }
+      },
+      "required": [
+        "Input"
+      ],
+      "additionalProperties": false
+    },
+    "DataSet": {
+      "type": "object",
+      "properties": {
+        "Type": {
+          "$ref": "#/definitions/DataSetType"
+        },
+        "Name": {
+          "type": "string",
+          "pattern": "^\\S{1,100}$"
+        },
+        "Ccsid": {
+          "type": "string",
+          "pattern": "^\\S{1,50}$"
+        },
+        "Format": {
+          "$ref": "#/definitions/Format"
+        },
+        "Length": {
+          "type": "number"
+        }
+      },
+      "required": [
+        "Ccsid",
+        "Format",
+        "Length",
+        "Name",
+        "Type"
+      ],
+      "additionalProperties": false
+    },
+    "DataSetType": {
+      "type": "string",
+      "enum": [
+        "PS"
+      ]
+    },
+    "DatabaseCDC": {
+      "type": "object",
+      "properties": {
+        "SourceMetadata": {
+          "$ref": "#/definitions/SourceDatabaseMetadata"
+        },
+        "TargetMetadata": {
+          "$ref": "#/definitions/TargetDatabaseMetadata"
+        }
+      },
+      "required": [
+        "SourceMetadata",
+        "TargetMetadata"
+      ],
+      "additionalProperties": false
+    },
+    "FileMetadata": {
+      "oneOf": [
+        {
+          "type": "object",
+          "title": "DataSets",
+          "properties": {
+            "DataSets": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/DataSet"
+              }
+            }
+          },
+          "required": [
+            "DataSets"
+          ],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "title": "DatabaseCDC",
+          "properties": {
+            "DatabaseCDC": {
+              "$ref": "#/definitions/DatabaseCDC"
+            }
+          },
+          "required": [
+            "DatabaseCDC"
+          ],
+          "additionalProperties": false
+        }
+      ]
+    },
+    "Format": {
+      "type": "string",
+      "enum": [
+        "FIXED",
+        "VARIABLE",
+        "LINE_SEQUENTIAL"
+      ]
+    },
+    "Input": {
+      "oneOf": [
+        {
+          "type": "object",
+          "title": "File",
+          "properties": {
+            "File": {
+              "$ref": "#/definitions/InputFile"
+            }
+          },
+          "required": [
+            "File"
+          ],
+          "additionalProperties": false
+        }
+      ]
+    },
+    "InputFile": {
+      "type": "object",
+      "properties": {
+        "SourceLocation": {
+          "type": "string",
+          "pattern": "^\\S{1,1000}$"
+        },
+        "TargetLocation": {
+          "type": "string",
+          "pattern": "^\\S{1,1000}$"
+        },
+        "FileMetadata": {
+          "$ref": "#/definitions/FileMetadata"
+        }
+      },
+      "required": [
+        "FileMetadata",
+        "SourceLocation",
+        "TargetLocation"
+      ],
+      "additionalProperties": false
+    },
+    "M2ManagedActionProperties": {
+      "type": "object",
+      "properties": {
+        "ForceStop": {
+          "type": "boolean"
+        },
+        "ImportDataSetLocation": {
+          "type": "string",
+          "pattern": "^\\S{1,1000}$"
+        }
+      },
+      "additionalProperties": false
+    },
+    "M2ManagedActionType": {
+      "type": "string",
+      "enum": [
+        "Configure",
+        "Deconfigure"
+      ]
+    },
+    "M2ManagedApplicationAction": {
+      "type": "object",
+      "properties": {
+        "Resource": {
+          "type": "string",
+          "pattern": "^\\S{1,1000}$"
+        },
+        "ActionType": {
+          "$ref": "#/definitions/M2ManagedActionType"
+        },
+        "Properties": {
+          "$ref": "#/definitions/M2ManagedActionProperties"
+        }
+      },
+      "required": [
+        "ActionType",
+        "Resource"
+      ],
+      "additionalProperties": false
+    },
+    "M2NonManagedActionType": {
+      "type": "string",
+      "enum": [
+        "Configure",
+        "Deconfigure"
+      ]
+    },
+    "M2NonManagedApplicationAction": {
+      "type": "object",
+      "properties": {
+        "Resource": {
+          "type": "string",
+          "pattern": "^\\S{1,1000}$"
+        },
+        "ActionType": {
+          "$ref": "#/definitions/M2NonManagedActionType"
+        }
+      },
+      "required": [
+        "ActionType",
+        "Resource"
+      ],
+      "additionalProperties": false
+    },
+    "MainframeAction": {
+      "type": "object",
+      "properties": {
+        "Resource": {
+          "type": "string",
+          "pattern": "^\\S{1,1000}$"
+        },
+        "ActionType": {
+          "$ref": "#/definitions/MainframeActionType"
+        },
+        "Properties": {
+          "$ref": "#/definitions/MainframeActionProperties"
+        }
+      },
+      "required": [
+        "ActionType",
+        "Resource"
+      ],
+      "additionalProperties": false
+    },
+    "MainframeActionProperties": {
+      "type": "object",
+      "properties": {
+        "DmsTaskArn": {
+          "type": "string",
+          "pattern": "^\\S{1,1000}$"
+        }
+      },
+      "additionalProperties": false
+    },
+    "MainframeActionType": {
+      "oneOf": [
+        {
+          "type": "object",
+          "title": "Batch",
+          "properties": {
+            "Batch": {
+              "$ref": "#/definitions/Batch"
+            }
+          },
+          "required": [
+            "Batch"
+          ],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "title": "Tn3270",
+          "properties": {
+            "Tn3270": {
+              "$ref": "#/definitions/TN3270"
+            }
+          },
+          "required": [
+            "Tn3270"
+          ],
+          "additionalProperties": false
+        }
+      ]
+    },
+    "Output": {
+      "oneOf": [
+        {
+          "type": "object",
+          "title": "File",
+          "properties": {
+            "File": {
+              "$ref": "#/definitions/OutputFile"
+            }
+          },
+          "required": [
+            "File"
+          ],
+          "additionalProperties": false
+        }
+      ]
+    },
+    "OutputFile": {
+      "type": "object",
+      "properties": {
+        "FileLocation": {
+          "type": "string",
+          "maxLength": 1024,
+          "minLength": 0
+        }
+      },
+      "additionalProperties": false
+    },
+    "ResourceAction": {
+      "oneOf": [
+        {
+          "type": "object",
+          "title": "M2ManagedApplicationAction",
+          "properties": {
+            "M2ManagedApplicationAction": {
+              "$ref": "#/definitions/M2ManagedApplicationAction"
+            }
+          },
+          "required": [
+            "M2ManagedApplicationAction"
+          ],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "title": "M2NonManagedApplicationAction",
+          "properties": {
+            "M2NonManagedApplicationAction": {
+              "$ref": "#/definitions/M2NonManagedApplicationAction"
+            }
+          },
+          "required": [
+            "M2NonManagedApplicationAction"
+          ],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "title": "CloudFormationAction",
+          "properties": {
+            "CloudFormationAction": {
+              "$ref": "#/definitions/CloudFormationAction"
+            }
+          },
+          "required": [
+            "CloudFormationAction"
+          ],
+          "additionalProperties": false
+        }
+      ]
+    },
+    "Script": {
+      "type": "object",
+      "properties": {
+        "ScriptLocation": {
+          "type": "string",
+          "maxLength": 1024,
+          "minLength": 0
+        },
+        "Type": {
+          "$ref": "#/definitions/ScriptType"
+        }
+      },
+      "required": [
+        "ScriptLocation",
+        "Type"
+      ],
+      "additionalProperties": false
+    },
+    "ScriptType": {
+      "type": "string",
+      "enum": [
+        "Selenium"
+      ]
+    },
+    "SourceDatabase": {
+      "type": "string",
+      "enum": [
+        "z/OS-DB2"
+      ]
+    },
+    "SourceDatabaseMetadata": {
+      "type": "object",
+      "properties": {
+        "Type": {
+          "$ref": "#/definitions/SourceDatabase"
+        },
+        "CaptureTool": {
+          "$ref": "#/definitions/CaptureTool"
+        }
+      },
+      "required": [
+        "CaptureTool",
+        "Type"
+      ],
+      "additionalProperties": false
+    },
+    "Step": {
+      "type": "object",
+      "properties": {
+        "Name": {
+          "type": "string",
+          "pattern": "^[A-Za-z][A-Za-z0-9_\\-]{1,59}$"
+        },
+        "Description": {
+          "type": "string",
+          "maxLength": 1000,
+          "minLength": 0
+        },
+        "Action": {
+          "$ref": "#/definitions/StepAction"
+        }
+      },
+      "required": [
+        "Action",
+        "Name"
+      ],
+      "additionalProperties": false
+    },
+    "StepAction": {
+      "oneOf": [
+        {
+          "type": "object",
+          "title": "ResourceAction",
+          "properties": {
+            "ResourceAction": {
+              "$ref": "#/definitions/ResourceAction"
+            }
+          },
+          "required": [
+            "ResourceAction"
+          ],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "title": "MainframeAction",
+          "properties": {
+            "MainframeAction": {
+              "$ref": "#/definitions/MainframeAction"
+            }
+          },
+          "required": [
+            "MainframeAction"
+          ],
+          "additionalProperties": false
+        },
+        {
+          "type": "object",
+          "title": "CompareAction",
+          "properties": {
+            "CompareAction": {
+              "$ref": "#/definitions/CompareAction"
+            }
+          },
+          "required": [
+            "CompareAction"
+          ],
+          "additionalProperties": false
+        }
+      ]
+    },
+    "TN3270": {
+      "type": "object",
+      "properties": {
+        "Script": {
+          "$ref": "#/definitions/Script"
+        },
+        "ExportDataSetNames": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "pattern": "^\\S{1,100}$"
+          }
+        }
+      },
+      "required": [
+        "Script"
+      ],
+      "additionalProperties": false
+    },
+    "TagMap": {
+      "type": "object",
+      "maxProperties": 200,
+      "minProperties": 0,
+      "patternProperties": {
+        "^(?!aws:).+$": {
+          "type": "string",
+          "maxLength": 256,
+          "minLength": 0
+        }
+      },
+      "additionalProperties": false
+    },
+    "TargetDatabase": {
+      "type": "string",
+      "enum": [
+        "PostgreSQL"
+      ]
+    },
+    "TargetDatabaseMetadata": {
+      "type": "object",
+      "properties": {
+        "Type": {
+          "$ref": "#/definitions/TargetDatabase"
+        },
+        "CaptureTool": {
+          "$ref": "#/definitions/CaptureTool"
+        }
+      },
+      "required": [
+        "CaptureTool",
+        "Type"
+      ],
+      "additionalProperties": false
+    },
+    "TestCaseLatestVersion": {
+      "type": "object",
+      "properties": {
+        "Version": {
+          "type": "number"
+        },
+        "Status": {
+          "$ref": "#/definitions/TestCaseLifecycle"
+        }
+      },
+      "required": [
+        "Status",
+        "Version"
+      ],
+      "additionalProperties": false
+    },
+    "TestCaseLifecycle": {
+      "type": "string",
+      "enum": [
+        "Active",
+        "Deleting"
+      ]
+    }
+  },
+  "properties": {
+    "CreationTime": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "Description": {
+      "type": "string",
+      "maxLength": 1000,
+      "minLength": 0
+    },
+    "LastUpdateTime": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "LatestVersion": {
+      "$ref": "#/definitions/TestCaseLatestVersion"
+    },
+    "Name": {
+      "type": "string",
+      "pattern": "^[A-Za-z][A-Za-z0-9_\\-]{1,59}$"
+    },
+    "Status": {
+      "$ref": "#/definitions/TestCaseLifecycle"
+    },
+    "Steps": {
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/Step"
+      },
+      "maxItems": 20,
+      "minItems": 1
+    },
+    "Tags": {
+      "$ref": "#/definitions/TagMap"
+    },
+    "TestCaseArn": {
+      "type": "string",
+      "pattern": "^arn:(aws|aws-cn|aws-iso|aws-iso-[a-z]{1}|aws-us-gov):[A-Za-z0-9][A-Za-z0-9_/.-]{0,62}:([a-z]{2}-((iso[a-z]{0,1}-)|(gov-)){0,1}[a-z]+-[0-9]):[0-9]{12}:[A-Za-z0-9/][A-Za-z0-9:_/+=,@.-]{0,1023}$"
+    },
+    "TestCaseId": {
+      "type": "string",
+      "pattern": "^[A-Za-z0-9:/\\-]{1,100}$"
+    },
+    "TestCaseVersion": {
+      "type": "number"
+    }
+  },
+  "required": [
+    "Name",
+    "Steps"
+  ],
+  "readOnlyProperties": [
+    "/properties/CreationTime",
+    "/properties/LastUpdateTime",
+    "/properties/LatestVersion",
+    "/properties/Status",
+    "/properties/TestCaseArn",
+    "/properties/TestCaseId",
+    "/properties/TestCaseVersion"
+  ],
+  "createOnlyProperties": [
+    "/properties/Name"
+  ],
+  "primaryIdentifier": [
+    "/properties/TestCaseId"
+  ],
+  "tagging": {
+    "taggable": true,
+    "tagOnCreate": true,
+    "tagUpdatable": true,
+    "cloudFormationSystemTags": false,
+    "tagProperty": "/properties/Tags",
+    "permissions": [
+      "apptest:TagResource",
+      "apptest:UntagResource",
+      "apptest:ListTagsForResource"
+    ]
+  },
+  "handlers": {
+    "create": {
+      "permissions": [
+        "apptest:CreateTestCase",
+        "apptest:GetTestCase",
+        "apptest:ListTagsForResource"
+      ]
+    },
+    "read": {
+      "permissions": [
+        "apptest:GetTestCase",
+        "apptest:ListTagsForResource"
+      ]
+    },
+    "update": {
+      "permissions": [
+        "apptest:UpdateTestCase",
+        "apptest:GetTestCase",
+        "apptest:TagResource",
+        "apptest:UnTagResource",
+        "apptest:ListTagsForResource"
+      ]
+    },
+    "delete": {
+      "permissions": [
+        "apptest:GetTestCase",
+        "apptest:ListTagsForResource",
+        "apptest:DeleteTestCase"
+      ]
+    },
+    "list": {
+      "permissions": [
+        "apptest:ListTestCases"
+      ]
+    }
+  },
+  "additionalProperties": false
+}
diff --git a/internal/aws/cfn/schemas/aws/autoscaling/autoscalinggroup.json b/internal/aws/cfn/schemas/aws/autoscaling/autoscalinggroup.json
index 120a6c15..b6c16889 100644
--- a/internal/aws/cfn/schemas/aws/autoscaling/autoscalinggroup.json
+++ b/internal/aws/cfn/schemas/aws/autoscaling/autoscalinggroup.json
@@ -107,7 +107,7 @@
         "managed-fleets:Get*",
         "managed-fleets:DeleteAutoScalingGroup"
       ],
-      "timeoutInMinutes": 180
+      "timeoutInMinutes": 240
     }
   },
   "writeOnlyProperties": [
diff --git a/internal/aws/cfn/schemas/aws/autoscaling/scalingpolicy.json b/internal/aws/cfn/schemas/aws/autoscaling/scalingpolicy.json
index 5f6226a0..157b6508 100644
--- a/internal/aws/cfn/schemas/aws/autoscaling/scalingpolicy.json
+++ b/internal/aws/cfn/schemas/aws/autoscaling/scalingpolicy.json
@@ -77,6 +77,14 @@
             "$ref": "#/definitions/MetricDimension"
           }
         },
+        "Metrics": {
+          "type": "array",
+          "insertionOrder": false,
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/definitions/TargetTrackingMetricDataQuery"
+          }
+        },
         "Statistic": {
           "type": "string"
         },
@@ -87,11 +95,7 @@
           "type": "string"
         }
       },
-      "required": [
-        "MetricName",
-        "Statistic",
-        "Namespace"
-      ]
+      "required": []
     },
     "TargetTrackingConfiguration": {
       "type": "object",
@@ -284,6 +288,25 @@
         "Namespace"
       ]
     },
+    "TargetTrackingMetricStat": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "Metric": {
+          "$ref": "#/definitions/Metric"
+        },
+        "Stat": {
+          "type": "string"
+        },
+        "Unit": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "Stat",
+        "Metric"
+      ]
+    },
     "MetricStat": {
       "type": "object",
       "additionalProperties": false,
@@ -303,6 +326,30 @@
         "Metric"
       ]
     },
+    "TargetTrackingMetricDataQuery": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "Label": {
+          "type": "string"
+        },
+        "MetricStat": {
+          "$ref": "#/definitions/TargetTrackingMetricStat"
+        },
+        "Id": {
+          "type": "string"
+        },
+        "ReturnData": {
+          "type": "boolean"
+        },
+        "Expression": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "Id"
+      ]
+    },
     "MetricDataQuery": {
       "type": "object",
       "additionalProperties": false,
diff --git a/internal/aws/cfn/schemas/aws/b2bi/capability.json b/internal/aws/cfn/schemas/aws/b2bi/capability.json
index 1d3d4e4c..b2e2c048 100644
--- a/internal/aws/cfn/schemas/aws/b2bi/capability.json
+++ b/internal/aws/cfn/schemas/aws/b2bi/capability.json
@@ -202,7 +202,8 @@
       "enum": [
         "VERSION_4010",
         "VERSION_4030",
-        "VERSION_5010"
+        "VERSION_5010",
+        "VERSION_5010_HIPAA"
       ]
     }
   },
diff --git a/internal/aws/cfn/schemas/aws/bedrock/agent.json b/internal/aws/cfn/schemas/aws/bedrock/agent.json
index de2ea94b..a5e62aa7 100644
--- a/internal/aws/cfn/schemas/aws/bedrock/agent.json
+++ b/internal/aws/cfn/schemas/aws/bedrock/agent.json
@@ -221,6 +221,24 @@
       ],
       "additionalProperties": false
     },
+    "GuardrailConfiguration": {
+      "type": "object",
+      "description": "Configuration for a guardrail.",
+      "properties": {
+        "GuardrailIdentifier": {
+          "type": "string",
+          "maxLength": 2048,
+          "pattern": "^(([a-z0-9]+)|(arn:aws(-[^:]+)?:bedrock:[a-z0-9-]{1,20}:[0-9]{12}:guardrail/[a-z0-9]+))$",
+          "description": "Identifier for the guardrail, could be the id or the arn"
+        },
+        "GuardrailVersion": {
+          "type": "string",
+          "pattern": "^(([0-9]{1,8})|(DRAFT))$",
+          "description": "Version of the guardrail"
+        }
+      },
+      "additionalProperties": false
+    },
     "InferenceConfiguration": {
       "type": "object",
       "description": "Configuration for inference in prompt configuration",
@@ -507,6 +525,9 @@
       "pattern": "^arn:aws(-[^:]+)?:bedrock:[a-z0-9-]{1,20}:(([0-9]{12}:custom-model/[a-z0-9-]{1,63}[.]{1}[a-z0-9-]{1,63}(([:][a-z0-9-]{1,63}){0,2})?/[a-z0-9]{12})|(:foundation-model/([a-z0-9-]{1,63}[.]{1}[a-z0-9-]{1,63}([.]?[a-z0-9-]{1,63})([:][a-z0-9-]{1,63}){0,2})))|(([a-z0-9-]{1,63}[.]{1}[a-z0-9-]{1,63}([.]?[a-z0-9-]{1,63})([:][a-z0-9-]{1,63}){0,2}))|(([0-9a-zA-Z][_-]?)+)$",
       "description": "ARN or name of a Bedrock model."
     },
+    "GuardrailConfiguration": {
+      "$ref": "#/definitions/GuardrailConfiguration"
+    },
     "IdleSessionTTLInSeconds": {
       "type": "number",
       "maximum": 3600,
@@ -594,6 +615,9 @@
         "bedrock:ListAgentActionGroups",
         "bedrock:TagResource",
         "bedrock:ListTagsForResource",
+        "bedrock:CreateGuardrail",
+        "bedrock:CreateGuardrailVersion",
+        "bedrock:GetGuardrail",
         "iam:PassRole"
       ]
     },
@@ -604,7 +628,9 @@
         "bedrock:ListAgentActionGroups",
         "bedrock:GetAgentKnowledgeBase",
         "bedrock:ListAgentKnowledgeBases",
-        "bedrock:ListTagsForResource"
+        "bedrock:ListTagsForResource",
+        "bedrock:GetGuardrail",
+        "kms:Decrypt"
       ]
     },
     "update": {
@@ -625,18 +651,24 @@
         "bedrock:TagResource",
         "bedrock:UntagResource",
         "bedrock:ListTagsForResource",
+        "bedrock:UpdateGuardrail",
+        "bedrock:GetGuardrail",
+        "kms:Decrypt",
         "iam:PassRole"
       ]
     },
     "delete": {
       "permissions": [
         "bedrock:GetAgent",
-        "bedrock:DeleteAgent"
+        "bedrock:DeleteAgent",
+        "bedrock:DeleteGuardrail",
+        "bedrock:GetGuardrail"
       ]
     },
     "list": {
       "permissions": [
-        "bedrock:ListAgents"
+        "bedrock:ListAgents",
+        "bedrock:ListGuardrails"
       ]
     }
   },
diff --git a/internal/aws/cfn/schemas/aws/bedrock/knowledgebase.json b/internal/aws/cfn/schemas/aws/bedrock/knowledgebase.json
index d1d76da8..497dd8e4 100644
--- a/internal/aws/cfn/schemas/aws/bedrock/knowledgebase.json
+++ b/internal/aws/cfn/schemas/aws/bedrock/knowledgebase.json
@@ -357,9 +357,9 @@
       "properties": {
         "EmbeddingModelArn": {
           "type": "string",
-          "maxLength": 1011,
+          "maxLength": 2048,
           "minLength": 20,
-          "pattern": "^arn:aws(-[^:]+)?:bedrock:[a-z0-9-]{1,20}:(([0-9]{12}:custom-model/[a-z0-9-]{1,63}[.]{1}[a-z0-9-]{1,63}/[a-z0-9]{12})|(:foundation-model/[a-z0-9-]{1,63}[.]{1}[a-z0-9-]{1,63}))$",
+          "pattern": "^(arn:aws(-[^:]+)?:bedrock:[a-z0-9-]{1,20}:(([0-9]{12}:custom-model/[a-z0-9-]{1,63}[.]{1}[a-z0-9-]{1,63}/[a-z0-9]{12})|(:foundation-model/[a-z0-9-]{1,63}[.]{1}[a-z0-9-]{1,63}([.:]?[a-z0-9-]{1,63}))|([0-9]{12}:provisioned-model/[a-z0-9]{12})))|([a-z0-9-]{1,63}[.]{1}[a-z0-9-]{1,63}([.:]?[a-z0-9-]{1,63}))|(([0-9a-zA-Z][_-]?)+)$",
           "description": "The ARN of the model used to create vector embeddings for the knowledge base."
         }
       },
diff --git a/internal/aws/cfn/schemas/aws/cognito/userpoolresourceserver.json b/internal/aws/cfn/schemas/aws/cognito/userpoolresourceserver.json
index 92587b0a..ec937cd1 100644
--- a/internal/aws/cfn/schemas/aws/cognito/userpoolresourceserver.json
+++ b/internal/aws/cfn/schemas/aws/cognito/userpoolresourceserver.json
@@ -1,7 +1,31 @@
 {
   "typeName": "AWS::Cognito::UserPoolResourceServer",
   "description": "Resource Type definition for AWS::Cognito::UserPoolResourceServer",
-  "additionalProperties": false,
+  "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-rpdk.git",
+  "tagging": {
+    "taggable": false,
+    "tagOnCreate": false,
+    "tagUpdatable": false,
+    "cloudFormationSystemTags": false
+  },
+  "definitions": {
+    "ResourceServerScopeType": {
+      "type": "object",
+      "properties": {
+        "ScopeDescription": {
+          "type": "string"
+        },
+        "ScopeName": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "ScopeDescription",
+        "ScopeName"
+      ],
+      "additionalProperties": false
+    }
+  },
   "properties": {
     "UserPoolId": {
       "type": "string"
@@ -9,51 +33,70 @@
     "Identifier": {
       "type": "string"
     },
-    "Id": {
+    "Name": {
       "type": "string"
     },
     "Scopes": {
       "type": "array",
-      "uniqueItems": false,
       "items": {
         "$ref": "#/definitions/ResourceServerScopeType"
       }
-    },
-    "Name": {
-      "type": "string"
-    }
-  },
-  "definitions": {
-    "ResourceServerScopeType": {
-      "type": "object",
-      "additionalProperties": false,
-      "properties": {
-        "ScopeName": {
-          "type": "string"
-        },
-        "ScopeDescription": {
-          "type": "string"
-        }
-      },
-      "required": [
-        "ScopeName",
-        "ScopeDescription"
-      ]
     }
   },
+  "additionalProperties": false,
   "required": [
     "UserPoolId",
     "Identifier",
     "Name"
   ],
   "createOnlyProperties": [
-    "/properties/Identifier",
-    "/properties/UserPoolId"
+    "/properties/UserPoolId",
+    "/properties/Identifier"
   ],
   "primaryIdentifier": [
-    "/properties/Id"
+    "/properties/UserPoolId",
+    "/properties/Identifier"
   ],
-  "readOnlyProperties": [
-    "/properties/Id"
-  ]
+  "handlers": {
+    "create": {
+      "permissions": [
+        "cognito-idp:CreateResourceServer",
+        "iam:PassRole"
+      ],
+      "timeoutInMinutes": 2
+    },
+    "read": {
+      "permissions": [
+        "cognito-idp:DescribeResourceServer"
+      ]
+    },
+    "update": {
+      "permissions": [
+        "cognito-idp:UpdateResourceServer",
+        "iam:PassRole"
+      ],
+      "timeoutInMinutes": 2
+    },
+    "delete": {
+      "permissions": [
+        "cognito-idp:DeleteResourceServer"
+      ],
+      "timeoutInMinutes": 2
+    },
+    "list": {
+      "handlerSchema": {
+        "properties": {
+          "UserPoolId": {
+            "$ref": "resource-schema.json#/properties/UserPoolId"
+          }
+        },
+        "required": [
+          "UserPoolId"
+        ]
+      },
+      "permissions": [
+        "cognito-idp:ListResourceServers"
+      ]
+    }
+  }
 }
diff --git a/internal/aws/cfn/schemas/aws/connect/rule.json b/internal/aws/cfn/schemas/aws/connect/rule.json
index d729daa4..1777c792 100644
--- a/internal/aws/cfn/schemas/aws/connect/rule.json
+++ b/internal/aws/cfn/schemas/aws/connect/rule.json
@@ -148,6 +148,21 @@
       ],
       "additionalProperties": false
     },
+    "SubmitAutoEvaluationAction": {
+      "description": "The definition of submit auto evaluation action.",
+      "type": "object",
+      "properties": {
+        "EvaluationFormArn": {
+          "description": "The Amazon Resource Name (ARN) of the evaluation form.",
+          "type": "string",
+          "pattern": "^$|arn:aws[-a-z0-9]*:connect:[-a-z0-9]*:[0-9]{12}:instance/[-a-zA-Z0-9]*/evaluation-form/[-a-zA-Z0-9]*$"
+        }
+      },
+      "required": [
+        "EvaluationFormArn"
+      ],
+      "additionalProperties": false
+    },
     "EventBridgeAction": {
       "description": "The definition for event bridge action.",
       "type": "object",
@@ -355,6 +370,17 @@
       "minItems": 1,
       "maxItems": 1
     },
+    "SubmitAutoEvaluationActions": {
+      "description": "This action will submit an auto contact evaluation when a rule is triggered.",
+      "type": "array",
+      "insertionOrder": false,
+      "uniqueItems": true,
+      "items": {
+        "$ref": "#/definitions/SubmitAutoEvaluationAction"
+      },
+      "minItems": 1,
+      "maxItems": 1
+    },
     "Actions": {
       "description": "The list of actions that will be executed when a rule is triggered.",
       "type": "object",
@@ -379,6 +405,9 @@
         },
         "EndAssociatedTasksActions": {
           "$ref": "#/definitions/EndAssociatedTasksActions"
+        },
+        "SubmitAutoEvaluationActions": {
+          "$ref": "#/definitions/SubmitAutoEvaluationActions"
         }
       },
       "additionalProperties": false
diff --git a/internal/aws/cfn/schemas/aws/datasync/agent.json b/internal/aws/cfn/schemas/aws/datasync/agent.json
index a9cf531e..83522dd5 100644
--- a/internal/aws/cfn/schemas/aws/datasync/agent.json
+++ b/internal/aws/cfn/schemas/aws/datasync/agent.json
@@ -35,7 +35,7 @@
       "type": "string",
       "pattern": "^[a-zA-Z0-9\\s+=._:@/-]+$",
       "maxLength": 256,
-      "minLength": 1
+      "minLength": 0
     },
     "ActivationKey": {
       "description": "Activation key of the Agent.",
diff --git a/internal/aws/cfn/schemas/aws/deadline/farm.json b/internal/aws/cfn/schemas/aws/deadline/farm.json
index 02b33fdf..a2c9c2c6 100644
--- a/internal/aws/cfn/schemas/aws/deadline/farm.json
+++ b/internal/aws/cfn/schemas/aws/deadline/farm.json
@@ -1,6 +1,31 @@
 {
   "typeName": "AWS::Deadline::Farm",
   "description": "Definition of AWS::Deadline::Farm Resource Type",
+  "definitions": {
+    "Tag": {
+      "description": "A key-value pair to associate with a resource.",
+      "type": "object",
+      "properties": {
+        "Key": {
+          "type": "string",
+          "description": "The key name of the tag. You can specify a value that is 1 to 127 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -. ",
+          "minLength": 1,
+          "maxLength": 127
+        },
+        "Value": {
+          "type": "string",
+          "description": "The value for the tag. You can specify a value that is 1 to 255 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -. ",
+          "minLength": 1,
+          "maxLength": 255
+        }
+      },
+      "required": [
+        "Key",
+        "Value"
+      ],
+      "additionalProperties": false
+    }
+  },
   "properties": {
     "Description": {
       "type": "string",
@@ -23,7 +48,17 @@
     },
     "Arn": {
       "type": "string",
-      "pattern": "^arn:(aws[a-zA-Z-]*):deadline:[a-z0-9-]+:[0-9]+:farm/.+?"
+      "pattern": "^arn:(aws[a-zA-Z-]*):deadline:[a-z0-9-]+:[0-9]+:farm/farm-[0-9a-z]{32}$"
+    },
+    "Tags": {
+      "type": "array",
+      "maxItems": 50,
+      "description": "An array of key-value pairs to apply to this resource.",
+      "items": {
+        "$ref": "#/definitions/Tag"
+      },
+      "insertionOrder": false,
+      "uniqueItems": true
     }
   },
   "required": [
@@ -34,10 +69,16 @@
     "/properties/Arn"
   ],
   "tagging": {
-    "taggable": false,
-    "tagOnCreate": false,
-    "tagUpdatable": false,
-    "cloudFormationSystemTags": false
+    "taggable": true,
+    "tagOnCreate": true,
+    "tagUpdatable": true,
+    "cloudFormationSystemTags": true,
+    "tagProperty": "/properties/Tags",
+    "permissions": [
+      "deadline:TagResource",
+      "deadline:UntagResource",
+      "deadline:ListTagsForResource"
+    ]
   },
   "createOnlyProperties": [
     "/properties/KmsKeyArn"
@@ -50,6 +91,9 @@
       "permissions": [
         "deadline:CreateFarm",
         "deadline:GetFarm",
+        "deadline:TagResource",
+        "deadline:ListTagsForResource",
+        "identitystore:ListGroupMembershipsForMember",
         "kms:Encrypt",
         "kms:Decrypt",
         "kms:CreateGrant",
@@ -59,6 +103,7 @@
     "read": {
       "permissions": [
         "deadline:GetFarm",
+        "deadline:ListTagsForResource",
         "identitystore:ListGroupMembershipsForMember",
         "kms:Encrypt",
         "kms:Decrypt",
@@ -70,6 +115,9 @@
       "permissions": [
         "deadline:UpdateFarm",
         "deadline:GetFarm",
+        "deadline:TagResource",
+        "deadline:UntagResource",
+        "deadline:ListTagsForResource",
         "identitystore:ListGroupMembershipsForMember",
         "kms:Encrypt",
         "kms:Decrypt",
diff --git a/internal/aws/cfn/schemas/aws/deadline/fleet.json b/internal/aws/cfn/schemas/aws/deadline/fleet.json
index ccdf33e2..7923eb8a 100644
--- a/internal/aws/cfn/schemas/aws/deadline/fleet.json
+++ b/internal/aws/cfn/schemas/aws/deadline/fleet.json
@@ -395,6 +395,29 @@
         "LINUX"
       ]
     },
+    "Tag": {
+      "description": "A key-value pair to associate with a resource.",
+      "type": "object",
+      "properties": {
+        "Key": {
+          "type": "string",
+          "description": "The key name of the tag. You can specify a value that is 1 to 127 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -. ",
+          "minLength": 1,
+          "maxLength": 127
+        },
+        "Value": {
+          "type": "string",
+          "description": "The value for the tag. You can specify a value that is 1 to 255 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -. ",
+          "minLength": 1,
+          "maxLength": 255
+        }
+      },
+      "required": [
+        "Key",
+        "Value"
+      ],
+      "additionalProperties": false
+    },
     "VCpuCountRange": {
       "type": "object",
       "properties": {
@@ -465,6 +488,16 @@
     "Arn": {
       "type": "string",
       "pattern": "^arn:(aws[a-zA-Z-]*):deadline:[a-z0-9-]+:[0-9]+:farm/farm-[0-9a-z]{32}/fleet/fleet-[0-9a-z]{32}"
+    },
+    "Tags": {
+      "type": "array",
+      "maxItems": 50,
+      "description": "An array of key-value pairs to apply to this resource.",
+      "items": {
+        "$ref": "#/definitions/Tag"
+      },
+      "insertionOrder": false,
+      "uniqueItems": true
     }
   },
   "required": [
@@ -487,10 +520,16 @@
     "/properties/Arn"
   ],
   "tagging": {
-    "taggable": false,
-    "tagOnCreate": false,
-    "tagUpdatable": false,
-    "cloudFormationSystemTags": false
+    "taggable": true,
+    "tagOnCreate": true,
+    "tagUpdatable": true,
+    "cloudFormationSystemTags": true,
+    "tagProperty": "/properties/Tags",
+    "permissions": [
+      "deadline:TagResource",
+      "deadline:UntagResource",
+      "deadline:ListTagsForResource"
+    ]
   },
   "handlers": {
     "create": {
@@ -499,13 +538,16 @@
         "deadline:GetFleet",
         "iam:PassRole",
         "identitystore:ListGroupMembershipsForMember",
-        "logs:CreateLogGroup"
+        "logs:CreateLogGroup",
+        "deadline:TagResource",
+        "deadline:ListTagsForResource"
       ]
     },
     "read": {
       "permissions": [
         "deadline:GetFleet",
-        "identitystore:ListGroupMembershipsForMember"
+        "identitystore:ListGroupMembershipsForMember",
+        "deadline:ListTagsForResource"
       ]
     },
     "update": {
@@ -513,7 +555,10 @@
         "deadline:UpdateFleet",
         "deadline:GetFleet",
         "iam:PassRole",
-        "identitystore:ListGroupMembershipsForMember"
+        "identitystore:ListGroupMembershipsForMember",
+        "deadline:TagResource",
+        "deadline:UntagResource",
+        "deadline:ListTagsForResource"
       ]
     },
     "delete": {
diff --git a/internal/aws/cfn/schemas/aws/deadline/licenseendpoint.json b/internal/aws/cfn/schemas/aws/deadline/licenseendpoint.json
index 17cf9e41..c2919d6b 100644
--- a/internal/aws/cfn/schemas/aws/deadline/licenseendpoint.json
+++ b/internal/aws/cfn/schemas/aws/deadline/licenseendpoint.json
@@ -10,6 +10,29 @@
         "READY",
         "NOT_READY"
       ]
+    },
+    "Tag": {
+      "description": "A key-value pair to associate with a resource.",
+      "type": "object",
+      "properties": {
+        "Key": {
+          "type": "string",
+          "description": "The key name of the tag. You can specify a value that is 1 to 127 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -. ",
+          "minLength": 1,
+          "maxLength": 127
+        },
+        "Value": {
+          "type": "string",
+          "description": "The value for the tag. You can specify a value that is 1 to 255 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -. ",
+          "minLength": 1,
+          "maxLength": 255
+        }
+      },
+      "required": [
+        "Key",
+        "Value"
+      ],
+      "additionalProperties": false
     }
   },
   "properties": {
@@ -54,6 +77,16 @@
     "Arn": {
       "type": "string",
       "pattern": "^arn:(aws[a-zA-Z-]*):deadline:[a-z0-9-]+:[0-9]{12}:license-endpoint/le-[0-9a-z]{32}"
+    },
+    "Tags": {
+      "type": "array",
+      "maxItems": 50,
+      "description": "An array of key-value pairs to apply to this resource.",
+      "items": {
+        "$ref": "#/definitions/Tag"
+      },
+      "insertionOrder": false,
+      "uniqueItems": true
     }
   },
   "required": [
@@ -77,10 +110,16 @@
     "/properties/Arn"
   ],
   "tagging": {
-    "taggable": false,
-    "tagOnCreate": false,
-    "tagUpdatable": false,
-    "cloudFormationSystemTags": false
+    "taggable": true,
+    "tagOnCreate": true,
+    "tagUpdatable": true,
+    "cloudFormationSystemTags": true,
+    "tagProperty": "/properties/Tags",
+    "permissions": [
+      "deadline:TagResource",
+      "deadline:UntagResource",
+      "deadline:ListTagsForResource"
+    ]
   },
   "handlers": {
     "create": {
@@ -89,11 +128,22 @@
         "deadline:GetLicenseEndpoint",
         "ec2:CreateTags",
         "ec2:CreateVpcEndpoint",
-        "ec2:DescribeVpcEndpoints"
+        "ec2:DescribeVpcEndpoints",
+        "deadline:TagResource",
+        "deadline:ListTagsForResource"
       ]
     },
     "read": {
       "permissions": [
+        "deadline:GetLicenseEndpoint",
+        "deadline:ListTagsForResource"
+      ]
+    },
+    "update": {
+      "permissions": [
+        "deadline:TagResource",
+        "deadline:UntagResource",
+        "deadline:ListTagsForResource",
         "deadline:GetLicenseEndpoint"
       ]
     },
diff --git a/internal/aws/cfn/schemas/aws/deadline/monitor.json b/internal/aws/cfn/schemas/aws/deadline/monitor.json
new file mode 100644
index 00000000..ee4b3e0f
--- /dev/null
+++ b/internal/aws/cfn/schemas/aws/deadline/monitor.json
@@ -0,0 +1,104 @@
+{
+  "typeName": "AWS::Deadline::Monitor",
+  "description": "Definition of AWS::Deadline::Monitor Resource Type",
+  "properties": {
+    "DisplayName": {
+      "type": "string",
+      "maxLength": 100,
+      "minLength": 1
+    },
+    "IdentityCenterApplicationArn": {
+      "type": "string"
+    },
+    "IdentityCenterInstanceArn": {
+      "type": "string",
+      "pattern": "^arn:(aws|aws-us-gov|aws-cn|aws-iso|aws-iso-b):sso:::instance/(sso)?ins-[a-zA-Z0-9-.]{16}$"
+    },
+    "MonitorId": {
+      "type": "string",
+      "pattern": "^monitor-[0-9a-f]{32}$"
+    },
+    "RoleArn": {
+      "type": "string",
+      "pattern": "^arn:(aws[a-zA-Z-]*):iam::\\d{12}:role(/[!-.0-~]+)*/[\\w+=,.@-]+$"
+    },
+    "Subdomain": {
+      "type": "string",
+      "pattern": "^[a-z0-9-]{1,100}$"
+    },
+    "Url": {
+      "type": "string"
+    },
+    "Arn": {
+      "type": "string",
+      "pattern": "^arn:(aws[a-zA-Z-]*):deadline:[a-z0-9-]+:[0-9]+:monitor/monitor-[0-9a-z]{32}$"
+    }
+  },
+  "required": [
+    "DisplayName",
+    "IdentityCenterInstanceArn",
+    "RoleArn",
+    "Subdomain"
+  ],
+  "readOnlyProperties": [
+    "/properties/IdentityCenterApplicationArn",
+    "/properties/MonitorId",
+    "/properties/Url",
+    "/properties/Arn"
+  ],
+  "createOnlyProperties": [
+    "/properties/IdentityCenterInstanceArn"
+  ],
+  "primaryIdentifier": [
+    "/properties/Arn"
+  ],
+  "tagging": {
+    "taggable": false,
+    "tagOnCreate": false,
+    "tagUpdatable": false,
+    "cloudFormationSystemTags": false
+  },
+  "handlers": {
+    "create": {
+      "permissions": [
+        "deadline:CreateMonitor",
+        "deadline:GetMonitor",
+        "iam:PassRole",
+        "kms:CreateGrant",
+        "sso:CreateApplication",
+        "sso:DeleteApplication",
+        "sso:PutApplicationAssignmentConfiguration",
+        "sso:PutApplicationAuthenticationMethod",
+        "sso:PutApplicationGrant"
+      ]
+    },
+    "read": {
+      "permissions": [
+        "deadline:GetMonitor"
+      ]
+    },
+    "update": {
+      "permissions": [
+        "deadline:GetMonitor",
+        "deadline:UpdateMonitor",
+        "iam:PassRole",
+        "kms:CreateGrant",
+        "sso:PutApplicationGrant",
+        "sso:UpdateApplication"
+      ]
+    },
+    "delete": {
+      "permissions": [
+        "deadline:DeleteMonitor",
+        "deadline:GetMonitor",
+        "sso:DeleteApplication"
+      ]
+    },
+    "list": {
+      "permissions": [
+        "deadline:ListMonitors"
+      ]
+    }
+  },
+  "additionalProperties": false
+}
diff --git a/internal/aws/cfn/schemas/aws/deadline/queue.json b/internal/aws/cfn/schemas/aws/deadline/queue.json
index fb95186b..730cbdcd 100644
--- a/internal/aws/cfn/schemas/aws/deadline/queue.json
+++ b/internal/aws/cfn/schemas/aws/deadline/queue.json
@@ -80,6 +80,29 @@
         "WORKER_AGENT_USER"
       ]
     },
+    "Tag": {
+      "description": "A key-value pair to associate with a resource.",
+      "type": "object",
+      "properties": {
+        "Key": {
+          "type": "string",
+          "description": "The key name of the tag. You can specify a value that is 1 to 127 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -. ",
+          "minLength": 1,
+          "maxLength": 127
+        },
+        "Value": {
+          "type": "string",
+          "description": "The value for the tag. You can specify a value that is 1 to 255 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -. ",
+          "minLength": 1,
+          "maxLength": 255
+        }
+      },
+      "required": [
+        "Key",
+        "Value"
+      ],
+      "additionalProperties": false
+    },
     "WindowsUser": {
       "type": "object",
       "properties": {
@@ -161,6 +184,16 @@
     "Arn": {
       "type": "string",
       "pattern": "^arn:*"
+    },
+    "Tags": {
+      "type": "array",
+      "maxItems": 50,
+      "description": "An array of key-value pairs to apply to this resource.",
+      "items": {
+        "$ref": "#/definitions/Tag"
+      },
+      "insertionOrder": false,
+      "uniqueItems": true
     }
   },
   "required": [
@@ -177,10 +210,16 @@
     "/properties/Arn"
   ],
   "tagging": {
-    "taggable": false,
-    "tagOnCreate": false,
-    "tagUpdatable": false,
-    "cloudFormationSystemTags": false
+    "taggable": true,
+    "tagOnCreate": true,
+    "tagUpdatable": true,
+    "cloudFormationSystemTags": true,
+    "tagProperty": "/properties/Tags",
+    "permissions": [
+      "deadline:TagResource",
+      "deadline:UntagResource",
+      "deadline:ListTagsForResource"
+    ]
   },
   "handlers": {
     "create": {
@@ -190,13 +229,16 @@
         "iam:PassRole",
         "identitystore:ListGroupMembershipsForMember",
         "logs:CreateLogGroup",
-        "s3:ListBucket"
+        "s3:ListBucket",
+        "deadline:TagResource",
+        "deadline:ListTagsForResource"
       ]
     },
     "read": {
       "permissions": [
         "deadline:GetQueue",
-        "identitystore:ListGroupMembershipsForMember"
+        "identitystore:ListGroupMembershipsForMember",
+        "deadline:ListTagsForResource"
       ]
     },
     "update": {
@@ -206,7 +248,10 @@
         "iam:PassRole",
         "identitystore:ListGroupMembershipsForMember",
         "logs:CreateLogGroup",
-        "s3:ListBucket"
+        "s3:ListBucket",
+        "deadline:TagResource",
+        "deadline:UntagResource",
+        "deadline:ListTagsForResource"
       ]
     },
     "delete": {
diff --git a/internal/aws/cfn/schemas/aws/ec2/customergateway.json b/internal/aws/cfn/schemas/aws/ec2/customergateway.json
index 63875e13..167af8fa 100644
--- a/internal/aws/cfn/schemas/aws/ec2/customergateway.json
+++ b/internal/aws/cfn/schemas/aws/ec2/customergateway.json
@@ -5,7 +5,7 @@
   "properties": {
     "CertificateArn": {
       "type": "string",
-      "description": "",
+      "description": "The Amazon Resource Name (ARN) for the customer gateway certificate.",
       "pattern": "^arn:(aws[a-zA-Z-]*)?:acm:[a-z]{2}((-gov)|(-iso(b?)))?-[a-z]+-\\d{1}:\\d{12}:certificate\\/[a-zA-Z0-9-_]+$"
     },
     "CustomerGatewayId": {
@@ -15,18 +15,18 @@
     "BgpAsn": {
       "type": "integer",
       "default": 65000,
-      "description": "For devices that support BGP, the customer gateway's BGP ASN.\n Default: 65000"
+      "description": "For customer gateway devices that support BGP, specify the device's ASN. You must specify either ``BgpAsn`` or ``BgpAsnExtended`` when creating the customer gateway. If the ASN is larger than ``2,147,483,647``, you must use ``BgpAsnExtended``.\n Default: 65000\n Valid values: ``1`` to ``2,147,483,647``"
     },
     "BgpAsnExtended": {
       "type": "number",
       "multipleOf": 1,
       "minimum": 2147483648,
       "maximum": 4294967294,
-      "description": ""
+      "description": "For customer gateway devices that support BGP, specify the device's ASN. You must specify either ``BgpAsn`` or ``BgpAsnExtended`` when creating the customer gateway. If the ASN is larger than ``2,147,483,647``, you must use ``BgpAsnExtended``.\n Valid values: ``2,147,483,648`` to ``4,294,967,295``"
     },
     "IpAddress": {
       "type": "string",
-      "description": "IPv4 address for the customer gateway device's outside interface. The address must be static.",
+      "description": "IPv4 address for the customer gateway device's outside interface. The address must be static. If ``OutsideIpAddressType`` in your VPN connection options is set to ``PrivateIpv4``, you can use an RFC6598 or RFC1918 private IPv4 address. If ``OutsideIpAddressType`` is set to ``PublicIpv4``, you can use a public IPv4 address.",
       "relationshipRef": {
         "typeName": "AWS::EC2::Instance",
         "propertyPath": "/properties/PublicIp"
diff --git a/internal/aws/cfn/schemas/aws/ec2/transitgatewayroute.json b/internal/aws/cfn/schemas/aws/ec2/transitgatewayroute.json
index 94fbcb27..2daa9d55 100644
--- a/internal/aws/cfn/schemas/aws/ec2/transitgatewayroute.json
+++ b/internal/aws/cfn/schemas/aws/ec2/transitgatewayroute.json
@@ -1,37 +1,80 @@
 {
+  "tagging": {
+    "taggable": false,
+    "tagOnCreate": false,
+    "tagUpdatable": false,
+    "cloudFormationSystemTags": false
+  },
   "typeName": "AWS::EC2::TransitGatewayRoute",
   "description": "Resource Type definition for AWS::EC2::TransitGatewayRoute",
+  "createOnlyProperties": [
+    "/properties/TransitGatewayRouteTableId",
+    "/properties/TransitGatewayAttachmentId",
+    "/properties/DestinationCidrBlock",
+    "/properties/Blackhole"
+  ],
+  "primaryIdentifier": [
+    "/properties/TransitGatewayRouteTableId",
+    "/properties/DestinationCidrBlock"
+  ],
+  "required": [
+    "TransitGatewayRouteTableId",
+    "DestinationCidrBlock"
+  ],
+  "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-transitgateway.git",
+  "handlers": {
+    "read": {
+      "permissions": [
+        "ec2:SearchTransitGatewayRoutes"
+      ]
+    },
+    "create": {
+      "permissions": [
+        "ec2:CreateTransitGatewayRoute",
+        "ec2:SearchTransitGatewayRoutes"
+      ]
+    },
+    "list": {
+      "permissions": [
+        "ec2:SearchTransitGatewayRoutes"
+      ],
+      "handlerSchema": {
+        "properties": {
+          "TransitGatewayRouteTableId": {
+            "$ref": "resource-schema.json#/properties/TransitGatewayRouteTableId"
+          }
+        },
+        "required": [
+          "TransitGatewayRouteTableId"
+        ]
+      }
+    },
+    "delete": {
+      "permissions": [
+        "ec2:DeleteTransitGatewayRoute",
+        "ec2:SearchTransitGatewayRoutes"
+      ]
+    }
+  },
   "additionalProperties": false,
+  "definitions": {},
   "properties": {
-    "Id": {
-      "type": "string"
-    },
     "TransitGatewayRouteTableId": {
+      "description": "The ID of transit gateway route table.",
       "type": "string"
     },
     "DestinationCidrBlock": {
+      "description": "The CIDR range used for destination matches. Routing decisions are based on the most specific match.",
       "type": "string"
     },
     "Blackhole": {
+      "description": "Indicates whether to drop traffic that matches this route.",
       "type": "boolean"
     },
     "TransitGatewayAttachmentId": {
+      "description": "The ID of transit gateway attachment.",
       "type": "string"
     }
   },
-  "required": [
-    "TransitGatewayRouteTableId"
-  ],
-  "createOnlyProperties": [
-    "/properties/TransitGatewayRouteTableId",
-    "/properties/TransitGatewayAttachmentId",
-    "/properties/DestinationCidrBlock",
-    "/properties/Blackhole"
-  ],
-  "readOnlyProperties": [
-    "/properties/Id"
-  ],
-  "primaryIdentifier": [
-    "/properties/Id"
-  ]
+  "replacementStrategy": "delete_then_create"
 }
diff --git a/internal/aws/cfn/schemas/aws/ec2/verifiedaccessinstance.json b/internal/aws/cfn/schemas/aws/ec2/verifiedaccessinstance.json
index 52bbc948..c821911e 100644
--- a/internal/aws/cfn/schemas/aws/ec2/verifiedaccessinstance.json
+++ b/internal/aws/cfn/schemas/aws/ec2/verifiedaccessinstance.json
@@ -203,6 +203,8 @@
         "ec2:ModifyVerifiedAccessInstanceLoggingConfiguration",
         "ec2:DescribeVerifiedAccessInstances",
         "ec2:DescribeVerifiedAccessInstanceLoggingConfigurations",
+        "ec2:DetachVerifiedAccessTrustProvider",
+        "ec2:DeleteVerifiedAccessInstance",
         "ec2:CreateTags",
         "ec2:DescribeTags",
         "logs:CreateLogDelivery",
diff --git a/internal/aws/cfn/schemas/aws/ec2/vpngateway.json b/internal/aws/cfn/schemas/aws/ec2/vpngateway.json
index 5cbc2bd8..566d8f2d 100644
--- a/internal/aws/cfn/schemas/aws/ec2/vpngateway.json
+++ b/internal/aws/cfn/schemas/aws/ec2/vpngateway.json
@@ -1,6 +1,6 @@
 {
   "typeName": "AWS::EC2::VPNGateway",
-  "description": "Schema for EC2 VPN Gateway",
+  "description": "Specifies a virtual private gateway. A virtual private gateway is the endpoint on the VPC side of your VPN connection. You can create a virtual private gateway before creating the VPC itself.\n For more information, see [](https://docs.aws.amazon.com/vpn/latest/s2svpn/VPC_VPN.html) in the *User Guide*.",
   "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-rpdk.git",
   "definitions": {
     "Tag": {
@@ -8,21 +8,24 @@
       "additionalProperties": false,
       "properties": {
         "Key": {
-          "type": "string"
+          "type": "string",
+          "description": "The tag key."
         },
         "Value": {
-          "type": "string"
+          "type": "string",
+          "description": "The tag value."
         }
       },
       "required": [
         "Value",
         "Key"
-      ]
+      ],
+      "description": "Specifies a tag. For more information, see [Add tags to a resource](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html#cloudformation-add-tag-specifications)."
     }
   },
   "properties": {
     "VPNGatewayId": {
-      "description": "VPN Gateway ID generated by service",
+      "description": "",
       "type": "string"
     },
     "AmazonSideAsn": {
@@ -69,7 +72,8 @@
     "create": {
       "permissions": [
         "ec2:CreateVpnGateway",
-        "ec2:DescribeVpnGateways"
+        "ec2:DescribeVpnGateways",
+        "ec2:CreateTags"
       ]
     },
     "read": {
@@ -79,13 +83,16 @@
     },
     "update": {
       "permissions": [
+        "ec2:DescribeVpnGateways",
         "ec2:CreateTags",
         "ec2:DeleteTags"
       ]
     },
     "delete": {
       "permissions": [
-        "ec2:DeleteVpnGateway"
+        "ec2:DeleteVpnGateway",
+        "ec2:DescribeVpnGateways",
+        "ec2:DeleteTags"
       ]
     },
     "list": {
diff --git a/internal/aws/cfn/schemas/aws/ecs/cluster.json b/internal/aws/cfn/schemas/aws/ecs/cluster.json
index 17883338..8225acd7 100644
--- a/internal/aws/cfn/schemas/aws/ecs/cluster.json
+++ b/internal/aws/cfn/schemas/aws/ecs/cluster.json
@@ -5,7 +5,8 @@
   "handlers": {
     "read": {
       "permissions": [
-        "ecs:DescribeClusters"
+        "ecs:DescribeClusters",
+        "kms:DescribeKey"
       ]
     },
     "create": {
@@ -13,7 +14,8 @@
         "ecs:CreateCluster",
         "ecs:DescribeClusters",
         "iam:CreateServiceLinkedRole",
-        "ecs:TagResource"
+        "ecs:TagResource",
+        "kms:DescribeKey"
       ]
     },
     "update": {
@@ -26,7 +28,8 @@
         "ecs:ListTagsForResource",
         "ecs:UpdateCluster",
         "ecs:UpdateClusterSettings",
-        "ecs:PutClusterCapacityProviders"
+        "ecs:PutClusterCapacityProviders",
+        "kms:DescribeKey"
       ]
     },
     "list": {
@@ -38,7 +41,8 @@
     "delete": {
       "permissions": [
         "ecs:DeleteCluster",
-        "ecs:DescribeClusters"
+        "ecs:DescribeClusters",
+        "kms:DescribeKey"
       ]
     }
   },
@@ -127,6 +131,19 @@
         }
       }
     },
+    "ManagedStorageConfiguration": {
+      "description": "",
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+        "FargateEphemeralStorageKmsKeyId": {
+          "type": "string"
+        },
+        "KmsKeyId": {
+          "type": "string"
+        }
+      }
+    },
     "ServiceConnectDefaults": {
       "description": "Use this parameter to set a default Service Connect namespace. After you set a default Service Connect namespace, any new services with Service Connect turned on that are created in the cluster are added as client services in the namespace. This setting only applies to new services that set the ``enabled`` parameter to ``true`` in the ``ServiceConnectConfiguration``. You can set the namespace of each service individually in the ``ServiceConnectConfiguration`` to override this default parameter.\n Tasks that run in a namespace can use short names to connect to services in the namespace. Tasks can connect to services across all of the clusters in the namespace. Tasks connect through a managed proxy container that collects logs and metrics for increased visibility. Only the tasks that Amazon ECS services create are supported with Service Connect. For more information, see [Service Connect](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/service-connect.html) in the *Amazon Elastic Container Service Developer Guide*.",
       "additionalProperties": false,
@@ -158,6 +175,10 @@
       "additionalProperties": false,
       "type": "object",
       "properties": {
+        "ManagedStorageConfiguration": {
+          "description": "",
+          "$ref": "#/definitions/ManagedStorageConfiguration"
+        },
         "ExecuteCommandConfiguration": {
           "description": "The details of the execute command configuration.",
           "$ref": "#/definitions/ExecuteCommandConfiguration"
diff --git a/internal/aws/cfn/schemas/aws/eks/cluster.json b/internal/aws/cfn/schemas/aws/eks/cluster.json
index bf50a152..afee7a6f 100644
--- a/internal/aws/cfn/schemas/aws/eks/cluster.json
+++ b/internal/aws/cfn/schemas/aws/eks/cluster.json
@@ -1,98 +1,271 @@
 {
+  "tagging": {
+    "taggable": true,
+    "tagOnCreate": true,
+    "tagUpdatable": true,
+    "tagProperty": "/properties/Tags",
+    "cloudFormationSystemTags": true
+  },
   "typeName": "AWS::EKS::Cluster",
+  "readOnlyProperties": [
+    "/properties/Id",
+    "/properties/Arn",
+    "/properties/Endpoint",
+    "/properties/CertificateAuthorityData",
+    "/properties/ClusterSecurityGroupId",
+    "/properties/EncryptionConfigKeyArn",
+    "/properties/OpenIdConnectIssuerUrl",
+    "/properties/KubernetesNetworkConfig/ServiceIpv6Cidr"
+  ],
   "description": "An object representing an Amazon EKS cluster.",
+  "createOnlyProperties": [
+    "/properties/OutpostConfig",
+    "/properties/EncryptionConfig",
+    "/properties/KubernetesNetworkConfig",
+    "/properties/AccessConfig/BootstrapClusterCreatorAdminPermissions",
+    "/properties/Name",
+    "/properties/RoleArn"
+  ],
+  "primaryIdentifier": [
+    "/properties/Name"
+  ],
+  "required": [
+    "RoleArn",
+    "ResourcesVpcConfig"
+  ],
   "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-eks.git",
+  "handlers": {
+    "read": {
+      "permissions": [
+        "eks:DescribeCluster"
+      ]
+    },
+    "create": {
+      "permissions": [
+        "eks:CreateCluster",
+        "eks:DescribeCluster",
+        "eks:TagResource",
+        "iam:PassRole",
+        "iam:GetRole",
+        "iam:ListAttachedRolePolicies",
+        "iam:CreateServiceLinkedRole",
+        "iam:CreateInstanceProfile",
+        "iam:TagInstanceProfile",
+        "iam:AddRoleToInstanceProfile",
+        "iam:GetInstanceProfile",
+        "iam:DeleteInstanceProfile",
+        "iam:RemoveRoleFromInstanceProfile",
+        "ec2:DescribeSubnets",
+        "ec2:DescribeVpcs",
+        "kms:DescribeKey",
+        "kms:CreateGrant"
+      ]
+    },
+    "update": {
+      "permissions": [
+        "iam:PassRole",
+        "eks:UpdateClusterConfig",
+        "eks:UpdateClusterVersion",
+        "eks:DescribeCluster",
+        "eks:DescribeUpdate",
+        "eks:TagResource",
+        "eks:UntagResource"
+      ],
+      "timeoutInMinutes": 180
+    },
+    "list": {
+      "permissions": [
+        "eks:ListClusters"
+      ]
+    },
+    "delete": {
+      "permissions": [
+        "eks:DeleteCluster",
+        "eks:DescribeCluster"
+      ]
+    }
+  },
+  "writeOnlyProperties": [
+    "/properties/AccessConfig/BootstrapClusterCreatorAdminPermissions"
+  ],
+  "additionalProperties": false,
   "definitions": {
+    "Logging": {
+      "description": "Enable exporting the Kubernetes control plane logs for your cluster to CloudWatch Logs based on log types. By default, cluster control plane logs aren't exported to CloudWatch Logs.",
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+        "ClusterLogging": {
+          "description": "The cluster control plane logging configuration for your cluster. ",
+          "$ref": "#/definitions/ClusterLogging"
+        }
+      }
+    },
+    "EnabledTypes": {
+      "description": "Enable control plane logs for your cluster, all log types will be disabled if the array is empty",
+      "insertionOrder": false,
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/LoggingTypeConfig"
+      }
+    },
     "Tag": {
       "description": "A key-value pair to associate with a resource.",
+      "additionalProperties": false,
       "type": "object",
       "properties": {
-        "Key": {
-          "type": "string",
-          "description": "The key name of the tag. You can specify a value that is 1 to 128 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -.",
-          "minLength": 1,
-          "maxLength": 128
-        },
         "Value": {
-          "type": "string",
-          "description": "The value for the tag. You can specify a value that is 0 to 256 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -.",
           "minLength": 0,
+          "description": "The value for the tag. You can specify a value that is 0 to 256 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -.",
+          "type": "string",
           "maxLength": 256
+        },
+        "Key": {
+          "minLength": 1,
+          "description": "The key name of the tag. You can specify a value that is 1 to 128 Unicode characters in length and cannot be prefixed with aws:. You can use any of the following characters: the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -.",
+          "type": "string",
+          "maxLength": 128
         }
       },
       "required": [
         "Key",
         "Value"
-      ],
-      "additionalProperties": false
+      ]
     },
-    "Provider": {
+    "ControlPlanePlacement": {
+      "description": "Specify the placement group of the control plane machines for your cluster.",
+      "additionalProperties": false,
       "type": "object",
+      "properties": {
+        "GroupName": {
+          "description": "Specify the placement group name of the control place machines for your cluster.",
+          "type": "string"
+        }
+      }
+    },
+    "OutpostConfig": {
+      "description": "An object representing the Outpost configuration to use for AWS EKS outpost cluster.",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
-        "KeyArn": {
-          "description": "Amazon Resource Name (ARN) or alias of the KMS key. The KMS key must be symmetric, created in the same region as the cluster, and if the KMS key was created in a different account, the user must have access to the KMS key.",
+        "OutpostArns": {
+          "description": "Specify one or more Arn(s) of Outpost(s) on which you would like to create your cluster.",
+          "insertionOrder": false,
+          "type": "array",
+          "items": {
+            "minItems": 1,
+            "type": "string"
+          }
+        },
+        "ControlPlanePlacement": {
+          "description": "Specify the placement group of the control plane machines for your cluster.",
+          "$ref": "#/definitions/ControlPlanePlacement"
+        },
+        "ControlPlaneInstanceType": {
+          "description": "Specify the Instance type of the machines that should be used to create your cluster.",
           "type": "string"
         }
+      },
+      "required": [
+        "OutpostArns",
+        "ControlPlaneInstanceType"
+      ]
+    },
+    "AccessConfig": {
+      "description": "An object representing the Access Config to use for the cluster.",
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+        "AuthenticationMode": {
+          "description": "Specify the authentication mode that should be used to create your cluster.",
+          "type": "string",
+          "enum": [
+            "CONFIG_MAP",
+            "API_AND_CONFIG_MAP",
+            "API"
+          ]
+        },
+        "BootstrapClusterCreatorAdminPermissions": {
+          "description": "Set this value to false to avoid creating a default cluster admin Access Entry using the IAM principal used to create the cluster.",
+          "type": "boolean"
+        }
       }
     },
     "EncryptionConfig": {
       "description": "The encryption configuration for the cluster",
+      "additionalProperties": false,
       "type": "object",
       "properties": {
-        "Provider": {
-          "description": "The encryption provider for the cluster.",
-          "$ref": "#/definitions/Provider"
-        },
         "Resources": {
           "description": "Specifies the resources to be encrypted. The only supported value is \"secrets\".",
-          "type": "array",
           "insertionOrder": false,
+          "type": "array",
           "items": {
             "type": "string"
           }
+        },
+        "Provider": {
+          "description": "The encryption provider for the cluster.",
+          "$ref": "#/definitions/Provider"
         }
-      },
-      "additionalProperties": false
+      }
+    },
+    "LoggingTypeConfig": {
+      "description": "Enabled Logging Type",
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+        "Type": {
+          "description": "name of the log type",
+          "type": "string",
+          "enum": [
+            "api",
+            "audit",
+            "authenticator",
+            "controllerManager",
+            "scheduler"
+          ]
+        }
+      }
     },
     "ResourcesVpcConfig": {
       "description": "An object representing the VPC configuration to use for an Amazon EKS cluster.",
-      "type": "object",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
-        "EndpointPrivateAccess": {
-          "description": "Set this value to true to enable private access for your cluster's Kubernetes API server endpoint. If you enable private access, Kubernetes API requests from within your cluster's VPC use the private VPC endpoint. The default value for this parameter is false, which disables private access for your Kubernetes API server. If you disable private access and you have nodes or AWS Fargate pods in the cluster, then ensure that publicAccessCidrs includes the necessary CIDR blocks for communication with the nodes or Fargate pods.",
-          "type": "boolean"
-        },
         "EndpointPublicAccess": {
           "description": "Set this value to false to disable public access to your cluster's Kubernetes API server endpoint. If you disable public access, your cluster's Kubernetes API server can only receive requests from within the cluster VPC. The default value for this parameter is true, which enables public access for your Kubernetes API server.",
           "type": "boolean"
         },
         "PublicAccessCidrs": {
           "description": "The CIDR blocks that are allowed access to your cluster's public Kubernetes API server endpoint. Communication to the endpoint from addresses outside of the CIDR blocks that you specify is denied. The default value is 0.0.0.0/0. If you've disabled private endpoint access and you have nodes or AWS Fargate pods in the cluster, then ensure that you specify the necessary CIDR blocks.",
-          "type": "array",
           "insertionOrder": false,
+          "type": "array",
           "items": {
-            "type": "string",
-            "minItems": 1
+            "minItems": 1,
+            "type": "string"
           }
         },
+        "EndpointPrivateAccess": {
+          "description": "Set this value to true to enable private access for your cluster's Kubernetes API server endpoint. If you enable private access, Kubernetes API requests from within your cluster's VPC use the private VPC endpoint. The default value for this parameter is false, which disables private access for your Kubernetes API server. If you disable private access and you have nodes or AWS Fargate pods in the cluster, then ensure that publicAccessCidrs includes the necessary CIDR blocks for communication with the nodes or Fargate pods.",
+          "type": "boolean"
+        },
         "SecurityGroupIds": {
           "description": "Specify one or more security groups for the cross-account elastic network interfaces that Amazon EKS creates to use to allow communication between your worker nodes and the Kubernetes control plane. If you don't specify a security group, the default security group for your VPC is used.",
-          "type": "array",
           "insertionOrder": false,
+          "type": "array",
           "items": {
-            "type": "string",
-            "minItems": 1
+            "minItems": 1,
+            "type": "string"
           }
         },
         "SubnetIds": {
           "description": "Specify subnets for your Amazon EKS nodes. Amazon EKS creates cross-account elastic network interfaces in these subnets to allow communication between your nodes and the Kubernetes control plane.",
-          "type": "array",
           "insertionOrder": false,
+          "type": "array",
           "items": {
-            "type": "string",
-            "minItems": 1
+            "minItems": 1,
+            "type": "string"
           }
         }
       },
@@ -100,53 +273,16 @@
         "SubnetIds"
       ]
     },
-    "LoggingTypeConfig": {
-      "description": "Enabled Logging Type",
-      "type": "object",
-      "properties": {
-        "Type": {
-          "description": "name of the log type",
-          "type": "string",
-          "enum": [
-            "api",
-            "audit",
-            "authenticator",
-            "controllerManager",
-            "scheduler"
-          ]
-        }
-      },
-      "additionalProperties": false
-    },
-    "EnabledTypes": {
-      "description": "Enable control plane logs for your cluster, all log types will be disabled if the array is empty",
-      "type": "array",
-      "insertionOrder": false,
-      "items": {
-        "$ref": "#/definitions/LoggingTypeConfig"
-      }
-    },
     "ClusterLogging": {
       "description": "The cluster control plane logging configuration for your cluster. ",
-      "type": "object",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
         "EnabledTypes": {
           "$ref": "#/definitions/EnabledTypes"
         }
       }
     },
-    "Logging": {
-      "description": "Enable exporting the Kubernetes control plane logs for your cluster to CloudWatch Logs based on log types. By default, cluster control plane logs aren't exported to CloudWatch Logs.",
-      "type": "object",
-      "additionalProperties": false,
-      "properties": {
-        "ClusterLogging": {
-          "description": "The cluster control plane logging configuration for your cluster. ",
-          "$ref": "#/definitions/ClusterLogging"
-        }
-      }
-    },
     "KubernetesNetworkConfig": {
       "description": "The Kubernetes network configuration for the cluster.",
       "additionalProperties": false,
@@ -170,229 +306,93 @@
         }
       }
     },
-    "ControlPlanePlacement": {
-      "description": "Specify the placement group of the control plane machines for your cluster.",
-      "type": "object",
-      "additionalProperties": false,
-      "properties": {
-        "GroupName": {
-          "description": "Specify the placement group name of the control place machines for your cluster.",
-          "type": "string"
-        }
-      }
-    },
-    "OutpostConfig": {
-      "description": "An object representing the Outpost configuration to use for AWS EKS outpost cluster.",
+    "Provider": {
       "additionalProperties": false,
       "type": "object",
       "properties": {
-        "OutpostArns": {
-          "description": "Specify one or more Arn(s) of Outpost(s) on which you would like to create your cluster.",
-          "type": "array",
-          "insertionOrder": false,
-          "items": {
-            "type": "string",
-            "minItems": 1
-          }
-        },
-        "ControlPlaneInstanceType": {
-          "description": "Specify the Instance type of the machines that should be used to create your cluster.",
+        "KeyArn": {
+          "description": "Amazon Resource Name (ARN) or alias of the KMS key. The KMS key must be symmetric, created in the same region as the cluster, and if the KMS key was created in a different account, the user must have access to the KMS key.",
           "type": "string"
-        },
-        "ControlPlanePlacement": {
-          "description": "Specify the placement group of the control plane machines for your cluster.",
-          "$ref": "#/definitions/ControlPlanePlacement"
-        }
-      },
-      "required": [
-        "OutpostArns",
-        "ControlPlaneInstanceType"
-      ]
-    },
-    "AccessConfig": {
-      "description": "An object representing the Access Config to use for the cluster.",
-      "additionalProperties": false,
-      "type": "object",
-      "properties": {
-        "BootstrapClusterCreatorAdminPermissions": {
-          "description": "Set this value to false to avoid creating a default cluster admin Access Entry using the IAM principal used to create the cluster.",
-          "type": "boolean"
-        },
-        "AuthenticationMode": {
-          "description": "Specify the authentication mode that should be used to create your cluster.",
-          "type": "string",
-          "enum": [
-            "CONFIG_MAP",
-            "API_AND_CONFIG_MAP",
-            "API"
-          ]
         }
       }
     }
   },
   "properties": {
+    "Logging": {
+      "$ref": "#/definitions/Logging"
+    },
+    "EncryptionConfigKeyArn": {
+      "description": "Amazon Resource Name (ARN) or alias of the customer master key (CMK).",
+      "type": "string"
+    },
+    "AccessConfig": {
+      "$ref": "#/definitions/AccessConfig"
+    },
+    "CertificateAuthorityData": {
+      "description": "The certificate-authority-data for your cluster.",
+      "type": "string"
+    },
     "EncryptionConfig": {
-      "type": "array",
       "insertionOrder": false,
+      "type": "array",
       "items": {
-        "$ref": "#/definitions/EncryptionConfig",
-        "maxItems": 1
+        "maxItems": 1,
+        "$ref": "#/definitions/EncryptionConfig"
       }
     },
     "KubernetesNetworkConfig": {
       "$ref": "#/definitions/KubernetesNetworkConfig"
     },
-    "Logging": {
-      "$ref": "#/definitions/Logging"
+    "RoleArn": {
+      "description": "The Amazon Resource Name (ARN) of the IAM role that provides permissions for the Kubernetes control plane to make calls to AWS API operations on your behalf.",
+      "type": "string"
     },
     "Name": {
+      "minLength": 1,
+      "pattern": "^[0-9A-Za-z][A-Za-z0-9\\-_]*",
       "description": "The unique name to give to your cluster.",
       "type": "string",
-      "pattern": "^[0-9A-Za-z][A-Za-z0-9\\-_]*",
-      "minLength": 1,
       "maxLength": 100
     },
+    "Endpoint": {
+      "description": "The endpoint for your Kubernetes API server, such as https://5E1D0CEXAMPLEA591B746AFC5AB30262.yl4.us-west-2.eks.amazonaws.com.",
+      "type": "string"
+    },
+    "Version": {
+      "pattern": "1\\.\\d\\d",
+      "description": "The desired Kubernetes version for your cluster. If you don't specify a value here, the latest version available in Amazon EKS is used.",
+      "type": "string"
+    },
+    "ClusterSecurityGroupId": {
+      "description": "The cluster security group that was created by Amazon EKS for the cluster. Managed node groups use this security group for control plane to data plane communication.",
+      "type": "string"
+    },
     "Id": {
       "description": "The unique ID given to your cluster.",
       "type": "string"
     },
-    "ResourcesVpcConfig": {
-      "$ref": "#/definitions/ResourcesVpcConfig"
-    },
     "OutpostConfig": {
       "$ref": "#/definitions/OutpostConfig"
     },
-    "AccessConfig": {
-      "$ref": "#/definitions/AccessConfig"
-    },
-    "RoleArn": {
-      "description": "The Amazon Resource Name (ARN) of the IAM role that provides permissions for the Kubernetes control plane to make calls to AWS API operations on your behalf.",
+    "Arn": {
+      "description": "The ARN of the cluster, such as arn:aws:eks:us-west-2:666666666666:cluster/prod.",
       "type": "string"
     },
-    "Version": {
-      "description": "The desired Kubernetes version for your cluster. If you don't specify a value here, the latest version available in Amazon EKS is used.",
-      "type": "string",
-      "pattern": "1\\.\\d\\d"
+    "ResourcesVpcConfig": {
+      "$ref": "#/definitions/ResourcesVpcConfig"
     },
     "Tags": {
-      "description": "An array of key-value pairs to apply to this resource.",
-      "type": "array",
       "uniqueItems": true,
+      "description": "An array of key-value pairs to apply to this resource.",
       "insertionOrder": false,
+      "type": "array",
       "items": {
         "$ref": "#/definitions/Tag"
       }
     },
-    "Arn": {
-      "description": "The ARN of the cluster, such as arn:aws:eks:us-west-2:666666666666:cluster/prod.",
-      "type": "string"
-    },
-    "Endpoint": {
-      "description": "The endpoint for your Kubernetes API server, such as https://5E1D0CEXAMPLEA591B746AFC5AB30262.yl4.us-west-2.eks.amazonaws.com.",
-      "type": "string"
-    },
-    "CertificateAuthorityData": {
-      "description": "The certificate-authority-data for your cluster.",
-      "type": "string"
-    },
-    "ClusterSecurityGroupId": {
-      "description": "The cluster security group that was created by Amazon EKS for the cluster. Managed node groups use this security group for control plane to data plane communication.",
-      "type": "string"
-    },
-    "EncryptionConfigKeyArn": {
-      "description": "Amazon Resource Name (ARN) or alias of the customer master key (CMK).",
-      "type": "string"
-    },
     "OpenIdConnectIssuerUrl": {
       "description": "The issuer URL for the cluster's OIDC identity provider, such as https://oidc.eks.us-west-2.amazonaws.com/id/EXAMPLED539D4633E53DE1B716D3041E. If you need to remove https:// from this output value, you can include the following code in your template.",
       "type": "string"
     }
-  },
-  "tagging": {
-    "taggable": true,
-    "tagOnCreate": true,
-    "tagUpdatable": true,
-    "cloudFormationSystemTags": true,
-    "tagProperty": "/properties/Tags"
-  },
-  "additionalProperties": false,
-  "required": [
-    "RoleArn",
-    "ResourcesVpcConfig"
-  ],
-  "primaryIdentifier": [
-    "/properties/Name"
-  ],
-  "createOnlyProperties": [
-    "/properties/OutpostConfig",
-    "/properties/EncryptionConfig",
-    "/properties/KubernetesNetworkConfig",
-    "/properties/AccessConfig/BootstrapClusterCreatorAdminPermissions",
-    "/properties/Name",
-    "/properties/RoleArn"
-  ],
-  "readOnlyProperties": [
-    "/properties/Id",
-    "/properties/Arn",
-    "/properties/Endpoint",
-    "/properties/CertificateAuthorityData",
-    "/properties/ClusterSecurityGroupId",
-    "/properties/EncryptionConfigKeyArn",
-    "/properties/OpenIdConnectIssuerUrl",
-    "/properties/KubernetesNetworkConfig/ServiceIpv6Cidr"
-  ],
-  "writeOnlyProperties": [
-    "/properties/AccessConfig/BootstrapClusterCreatorAdminPermissions"
-  ],
-  "handlers": {
-    "create": {
-      "permissions": [
-        "eks:CreateCluster",
-        "eks:DescribeCluster",
-        "eks:TagResource",
-        "iam:PassRole",
-        "iam:GetRole",
-        "iam:ListAttachedRolePolicies",
-        "iam:CreateServiceLinkedRole",
-        "iam:CreateInstanceProfile",
-        "iam:TagInstanceProfile",
-        "iam:AddRoleToInstanceProfile",
-        "iam:GetInstanceProfile",
-        "iam:DeleteInstanceProfile",
-        "iam:RemoveRoleFromInstanceProfile",
-        "ec2:DescribeSubnets",
-        "ec2:DescribeVpcs",
-        "kms:DescribeKey",
-        "kms:CreateGrant"
-      ]
-    },
-    "read": {
-      "permissions": [
-        "eks:DescribeCluster"
-      ]
-    },
-    "update": {
-      "permissions": [
-        "iam:PassRole",
-        "eks:UpdateClusterConfig",
-        "eks:UpdateClusterVersion",
-        "eks:DescribeCluster",
-        "eks:DescribeUpdate",
-        "eks:TagResource",
-        "eks:UntagResource"
-      ],
-      "timeoutInMinutes": 180
-    },
-    "delete": {
-      "permissions": [
-        "eks:DeleteCluster",
-        "eks:DescribeCluster"
-      ]
-    },
-    "list": {
-      "permissions": [
-        "eks:ListClusters"
-      ]
-    }
   }
 }
diff --git a/internal/aws/cfn/schemas/aws/elasticloadbalancingv2/loadbalancer.json b/internal/aws/cfn/schemas/aws/elasticloadbalancingv2/loadbalancer.json
index 8678c14e..bec0d1d8 100644
--- a/internal/aws/cfn/schemas/aws/elasticloadbalancingv2/loadbalancer.json
+++ b/internal/aws/cfn/schemas/aws/elasticloadbalancingv2/loadbalancer.json
@@ -1,217 +1,217 @@
 {
-  "typeName": "AWS::ElasticLoadBalancingV2::LoadBalancer",
-  "description": "Specifies an Application Load Balancer, a Network Load Balancer, or a Gateway Load Balancer.",
   "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-elasticloadbalancingv2",
   "documentationUrl": "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-elasticloadbalancingv2-loadbalancer.html",
+  "tagging": {
+    "taggable": true,
+    "tagOnCreate": true,
+    "tagUpdatable": true,
+    "tagProperty": "/properties/Tags",
+    "cloudFormationSystemTags": false
+  },
+  "handlers": {
+    "read": {
+      "permissions": [
+        "elasticloadbalancing:DescribeLoadBalancers",
+        "elasticloadbalancing:DescribeLoadBalancerAttributes",
+        "elasticloadbalancing:DescribeTags"
+      ]
+    },
+    "create": {
+      "permissions": [
+        "elasticloadbalancing:CreateLoadBalancer",
+        "elasticloadbalancing:DescribeLoadBalancers",
+        "elasticloadbalancing:ModifyLoadBalancerAttributes",
+        "elasticloadbalancing:AddTags"
+      ],
+      "timeoutInMinutes": 30
+    },
+    "update": {
+      "permissions": [
+        "elasticloadbalancing:ModifyLoadBalancerAttributes",
+        "elasticloadbalancing:SetSubnets",
+        "elasticloadbalancing:SetIpAddressType",
+        "elasticloadbalancing:SetSecurityGroups",
+        "elasticloadbalancing:AddTags",
+        "elasticloadbalancing:RemoveTags"
+      ]
+    },
+    "list": {
+      "permissions": [
+        "elasticloadbalancing:DescribeLoadBalancers"
+      ]
+    },
+    "delete": {
+      "permissions": [
+        "elasticloadbalancing:DescribeLoadBalancers",
+        "elasticloadbalancing:DeleteLoadBalancer"
+      ]
+    }
+  },
+  "typeName": "AWS::ElasticLoadBalancingV2::LoadBalancer",
+  "readOnlyProperties": [
+    "/properties/LoadBalancerName",
+    "/properties/LoadBalancerFullName",
+    "/properties/CanonicalHostedZoneID",
+    "/properties/LoadBalancerArn",
+    "/properties/DNSName"
+  ],
+  "description": "Specifies an Application Load Balancer, a Network Load Balancer, or a Gateway Load Balancer.",
+  "createOnlyProperties": [
+    "/properties/Name",
+    "/properties/Type",
+    "/properties/Scheme"
+  ],
   "additionalProperties": false,
+  "primaryIdentifier": [
+    "/properties/LoadBalancerArn"
+  ],
+  "definitions": {
+    "SubnetMapping": {
+      "description": "Specifies a subnet for a load balancer.",
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+        "AllocationId": {
+          "description": "[Network Load Balancers] The allocation ID of the Elastic IP address for an internet-facing load balancer.",
+          "type": "string"
+        },
+        "IPv6Address": {
+          "description": "[Network Load Balancers] The IPv6 address.",
+          "type": "string"
+        },
+        "SubnetId": {
+          "description": "The ID of the subnet.",
+          "type": "string"
+        },
+        "PrivateIPv4Address": {
+          "description": "[Network Load Balancers] The private IPv4 address for an internal load balancer.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "SubnetId"
+      ]
+    },
+    "LoadBalancerAttribute": {
+      "description": "Specifies an attribute for an Application Load Balancer, a Network Load Balancer, or a Gateway Load Balancer.",
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+        "Value": {
+          "description": "The value of the attribute.",
+          "type": "string"
+        },
+        "Key": {
+          "description": "The name of the attribute.\n The following attributes are supported by all load balancers:\n  +   ``deletion_protection.enabled`` - Indicates whether deletion protection is enabled. The value is ``true`` or ``false``. The default is ``false``.\n  +   ``load_balancing.cross_zone.enabled`` - Indicates whether cross-zone load balancing is enabled. The possible values are ``true`` and ``false``. The default for Network Load Balancers and Gateway Load Balancers is ``false``. The default for Application Load Balancers is ``true``, and cannot be changed.\n  \n The following attributes are supported by both Application Load Balancers and Network Load Balancers:\n  +   ``access_logs.s3.enabled`` - Indicates whether access logs are enabled. The value is ``true`` or ``false``. The default is ``false``.\n  +   ``access_logs.s3.bucket`` - The name of the S3 bucket for the access logs. This attribute is required if access logs are enabled. The bucket must exist in the same region as the load balancer and have a bucket policy that grants Elastic Load Balancing permissions to write to the bucket.\n  +   ``access_logs.s3.prefix`` - The prefix for the location in the S3 bucket for the access logs.\n  +   ``ipv6.deny_all_igw_traffic`` - Blocks internet gateway (IGW) access to the load balancer. It is set to ``false`` for internet-facing load balancers and ``true`` for internal load balancers, preventing unintended access to your internal load balancer through an internet gateway.\n  \n The following attributes are supported by only Application Load Balancers:\n  +   ``idle_timeout.timeout_seconds`` - The idle timeout value, in seconds. The valid range is 1-4000 seconds. The default is 60 seconds.\n  +   ``client_keep_alive.seconds`` - The client keep alive value, in seconds. The valid range is 60-604800 seconds. The default is 3600 seconds.\n  +   ``connection_logs.s3.enabled`` - Indicates whether connection logs are enabled. The value is ``true`` or ``false``. The default is ``false``.\n  +   ``connection_logs.s3.bucket`` - The name of the S3 bucket for the connection logs. This attribute is required if connection logs are enabled. The bucket must exist in the same region as the load balancer and have a bucket policy that grants Elastic Load Balancing permissions to write to the bucket.\n  +   ``connection_logs.s3.prefix`` - The prefix for the location in the S3 bucket for the connection logs.\n  +   ``routing.http.desync_mitigation_mode`` - Determines how the load balancer handles requests that might pose a security risk to your application. The possible values are ``monitor``, ``defensive``, and ``strictest``. The default is ``defensive``.\n  +   ``routing.http.drop_invalid_header_fields.enabled`` - Indicates whether HTTP headers with invalid header fields are removed by the load balancer (``true``) or routed to targets (``false``). The default is ``false``.\n  +   ``routing.http.preserve_host_header.enabled`` - Indicates whether the Application Load Balancer should preserve the ``Host`` header in the HTTP request and send it to the target without any change. The possible values are ``true`` and ``false``. The default is ``false``.\n  +   ``routing.http.x_amzn_tls_version_and_cipher_suite.enabled`` - Indicates whether the two headers (``x-amzn-tls-version`` and ``x-amzn-tls-cipher-suite``), which contain information about the negotiated TLS version and cipher suite, are added to the client request before sending it to the target. The ``x-amzn-tls-version`` header has information about the TLS protocol version negotiated with the client, and the ``x-amzn-tls-cipher-suite`` header has information about the cipher suite negotiated with the client. Both headers are in OpenSSL format. The possible values for the attribute are ``true`` and ``false``. The default is ``false``.\n  +   ``routing.http.xff_client_port.enabled`` - Indicates whether the ``X-Forwarded-For`` header should preserve the source port that the client used to connect to the load balancer. The possible values are ``true`` and ``false``. The default is ``false``.\n  +   ``routing.http.xff_header_processing.mode`` - Enables you to modify, preserve, or remove the ``X-Forwarded-For`` header in the HTTP request before the Application Load Balancer sends the request to the target. The possible values are ``append``, ``preserve``, and ``remove``. The default is ``append``.\n  +  If the value is ``append``, the Application Load Balancer adds the client IP address (of the last hop) to the ``X-Forwarded-For`` header in the HTTP request before it sends it to targets.\n  +  If the value is ``preserve`` the Application Load Balancer preserves the ``X-Forwarded-For`` header in the HTTP request, and sends it to targets without any change.\n  +  If the value is ``remove``, the Application Load Balancer removes the ``X-Forwarded-For`` header in the HTTP request before it sends it to targets.\n  \n  +   ``routing.http2.enabled`` - Indicates whether HTTP/2 is enabled. The possible values are ``true`` and ``false``. The default is ``true``. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens.\n  +   ``waf.fail_open.enabled`` - Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. The possible values are ``true`` and ``false``. The default is ``false``.\n  \n The following attributes are supported by only Network Load Balancers:\n  +   ``dns_record.client_routing_policy`` - Indicates how traffic is distributed among the load balancer Availability Zones. The possible values are ``availability_zone_affinity`` with 100 percent zonal affinity, ``partial_availability_zone_affinity`` with 85 percent zonal affinity, and ``any_availability_zone`` with 0 percent zonal affinity.",
+          "type": "string"
+        }
+      }
+    },
+    "Tag": {
+      "description": "Information about a tag.",
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+        "Value": {
+          "description": "The value of the tag.",
+          "type": "string"
+        },
+        "Key": {
+          "description": "The key of the tag.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "Key"
+      ]
+    }
+  },
   "properties": {
     "IpAddressType": {
-      "type": "string",
-      "description": "The IP address type. The possible values are ``ipv4`` (for IPv4 addresses) and ``dualstack`` (for IPv4 and IPv6 addresses). You can?t specify ``dualstack`` for a load balancer with a UDP or TCP_UDP listener."
+      "description": "Note: Internal load balancers must use the ``ipv4`` IP address type.\n [Application Load Balancers] The IP address type. The possible values are ``ipv4`` (for only IPv4 addresses), ``dualstack`` (for IPv4 and IPv6 addresses), and ``dualstack-without-public-ipv4`` (for IPv6 only public addresses, with private IPv4 and IPv6 addresses).\n [Network Load Balancers] The IP address type. The possible values are ``ipv4`` (for only IPv4 addresses) and ``dualstack`` (for IPv4 and IPv6 addresses). You can’t specify ``dualstack`` for a load balancer with a UDP or TCP_UDP listener.\n [Gateway Load Balancers] The IP address type. The possible values are ``ipv4`` (for only IPv4 addresses) and ``dualstack`` (for IPv4 and IPv6 addresses).",
+      "type": "string"
     },
     "SecurityGroups": {
-      "type": "array",
-      "description": "[Application Load Balancers and Network Load Balancers] The IDs of the security groups for the load balancer.",
       "uniqueItems": true,
+      "description": "[Application Load Balancers and Network Load Balancers] The IDs of the security groups for the load balancer.",
       "insertionOrder": false,
+      "type": "array",
       "items": {
         "type": "string"
       }
     },
     "LoadBalancerAttributes": {
-      "type": "array",
-      "description": "The load balancer attributes.",
+      "arrayType": "AttributeList",
       "uniqueItems": true,
+      "description": "The load balancer attributes.",
       "insertionOrder": false,
-      "arrayType": "AttributeList",
+      "type": "array",
       "items": {
         "$ref": "#/definitions/LoadBalancerAttribute"
       }
     },
     "Scheme": {
-      "type": "string",
-      "description": "The nodes of an Internet-facing load balancer have public IP addresses. The DNS name of an Internet-facing load balancer is publicly resolvable to the public IP addresses of the nodes. Therefore, Internet-facing load balancers can route requests from clients over the internet.\n The nodes of an internal load balancer have only private IP addresses. The DNS name of an internal load balancer is publicly resolvable to the private IP addresses of the nodes. Therefore, internal load balancers can route requests only from clients with access to the VPC for the load balancer.\n The default is an Internet-facing load balancer.\n You cannot specify a scheme for a Gateway Load Balancer."
+      "description": "The nodes of an Internet-facing load balancer have public IP addresses. The DNS name of an Internet-facing load balancer is publicly resolvable to the public IP addresses of the nodes. Therefore, Internet-facing load balancers can route requests from clients over the internet.\n The nodes of an internal load balancer have only private IP addresses. The DNS name of an internal load balancer is publicly resolvable to the private IP addresses of the nodes. Therefore, internal load balancers can route requests only from clients with access to the VPC for the load balancer.\n The default is an Internet-facing load balancer.\n You cannot specify a scheme for a Gateway Load Balancer.",
+      "type": "string"
     },
     "DNSName": {
-      "type": "string",
-      "description": ""
+      "description": "",
+      "type": "string"
     },
     "Name": {
-      "type": "string",
-      "description": "The name of the load balancer. This name must be unique per region per account, can have a maximum of 32 characters, must contain only alphanumeric characters or hyphens, must not begin or end with a hyphen, and must not begin with \"internal-\".\n If you don't specify a name, AWS CloudFormation generates a unique physical ID for the load balancer. If you specify a name, you cannot perform updates that require replacement of this resource, but you can perform other updates. To replace the resource, specify a new name."
+      "description": "The name of the load balancer. This name must be unique per region per account, can have a maximum of 32 characters, must contain only alphanumeric characters or hyphens, must not begin or end with a hyphen, and must not begin with \"internal-\".\n If you don't specify a name, AWS CloudFormation generates a unique physical ID for the load balancer. If you specify a name, you cannot perform updates that require replacement of this resource, but you can perform other updates. To replace the resource, specify a new name.",
+      "type": "string"
     },
     "LoadBalancerName": {
-      "type": "string",
-      "description": ""
-    },
-    "LoadBalancerFullName": {
-      "type": "string",
-      "description": ""
+      "description": "",
+      "type": "string"
     },
     "Subnets": {
-      "type": "array",
-      "description": "The IDs of the subnets. You can specify only one subnet per Availability Zone. You must specify either subnets or subnet mappings, but not both. To specify an Elastic IP address, specify subnet mappings instead of subnets.\n [Application Load Balancers] You must specify subnets from at least two Availability Zones.\n [Application Load Balancers on Outposts] You must specify one Outpost subnet.\n [Application Load Balancers on Local Zones] You can specify subnets from one or more Local Zones.\n [Network Load Balancers] You can specify subnets from one or more Availability Zones.\n [Gateway Load Balancers] You can specify subnets from one or more Availability Zones.",
       "uniqueItems": true,
+      "description": "The IDs of the subnets. You can specify only one subnet per Availability Zone. You must specify either subnets or subnet mappings, but not both. To specify an Elastic IP address, specify subnet mappings instead of subnets.\n [Application Load Balancers] You must specify subnets from at least two Availability Zones.\n [Application Load Balancers on Outposts] You must specify one Outpost subnet.\n [Application Load Balancers on Local Zones] You can specify subnets from one or more Local Zones.\n [Network Load Balancers] You can specify subnets from one or more Availability Zones.\n [Gateway Load Balancers] You can specify subnets from one or more Availability Zones.",
       "insertionOrder": false,
+      "type": "array",
       "items": {
         "type": "string"
       }
     },
     "Type": {
-      "type": "string",
-      "description": "The type of load balancer. The default is ``application``."
+      "description": "The type of load balancer. The default is ``application``.",
+      "type": "string"
     },
     "CanonicalHostedZoneID": {
-      "type": "string",
-      "description": ""
+      "description": "",
+      "type": "string"
+    },
+    "LoadBalancerArn": {
+      "description": "",
+      "type": "string"
+    },
+    "EnforceSecurityGroupInboundRulesOnPrivateLinkTraffic": {
+      "description": "Indicates whether to evaluate inbound security group rules for traffic sent to a Network Load Balancer through privatelink.",
+      "type": "string"
     },
     "Tags": {
-      "type": "array",
-      "description": "The tags to assign to the load balancer.",
       "uniqueItems": false,
+      "description": "The tags to assign to the load balancer.",
       "insertionOrder": false,
+      "type": "array",
       "items": {
         "$ref": "#/definitions/Tag"
       }
     },
-    "LoadBalancerArn": {
-      "type": "string",
-      "description": ""
+    "LoadBalancerFullName": {
+      "description": "",
+      "type": "string"
     },
     "SubnetMappings": {
-      "type": "array",
-      "description": "The IDs of the subnets. You can specify only one subnet per Availability Zone. You must specify either subnets or subnet mappings, but not both.\n [Application Load Balancers] You must specify subnets from at least two Availability Zones. You cannot specify Elastic IP addresses for your subnets.\n [Application Load Balancers on Outposts] You must specify one Outpost subnet.\n [Application Load Balancers on Local Zones] You can specify subnets from one or more Local Zones.\n [Network Load Balancers] You can specify subnets from one or more Availability Zones. You can specify one Elastic IP address per subnet if you need static IP addresses for your internet-facing load balancer. For internal load balancers, you can specify one private IP address per subnet from the IPv4 range of the subnet. For internet-facing load balancer, you can specify one IPv6 address per subnet.\n [Gateway Load Balancers] You can specify subnets from one or more Availability Zones. You cannot specify Elastic IP addresses for your subnets.",
       "uniqueItems": true,
+      "description": "The IDs of the subnets. You can specify only one subnet per Availability Zone. You must specify either subnets or subnet mappings, but not both.\n [Application Load Balancers] You must specify subnets from at least two Availability Zones. You cannot specify Elastic IP addresses for your subnets.\n [Application Load Balancers on Outposts] You must specify one Outpost subnet.\n [Application Load Balancers on Local Zones] You can specify subnets from one or more Local Zones.\n [Network Load Balancers] You can specify subnets from one or more Availability Zones. You can specify one Elastic IP address per subnet if you need static IP addresses for your internet-facing load balancer. For internal load balancers, you can specify one private IP address per subnet from the IPv4 range of the subnet. For internet-facing load balancer, you can specify one IPv6 address per subnet.\n [Gateway Load Balancers] You can specify subnets from one or more Availability Zones. You cannot specify Elastic IP addresses for your subnets.",
       "insertionOrder": false,
+      "type": "array",
       "items": {
         "$ref": "#/definitions/SubnetMapping"
       }
-    },
-    "EnforceSecurityGroupInboundRulesOnPrivateLinkTraffic": {
-      "type": "string",
-      "description": "Indicates whether to evaluate inbound security group rules for traffic sent to a Network Load Balancer through privatelink."
-    }
-  },
-  "definitions": {
-    "SubnetMapping": {
-      "type": "object",
-      "additionalProperties": false,
-      "properties": {
-        "SubnetId": {
-          "type": "string",
-          "description": "The ID of the subnet."
-        },
-        "AllocationId": {
-          "type": "string",
-          "description": "[Network Load Balancers] The allocation ID of the Elastic IP address for an internet-facing load balancer."
-        },
-        "PrivateIPv4Address": {
-          "type": "string",
-          "description": "[Network Load Balancers] The private IPv4 address for an internal load balancer."
-        },
-        "IPv6Address": {
-          "type": "string",
-          "description": "[Network Load Balancers] The IPv6 address."
-        }
-      },
-      "required": [
-        "SubnetId"
-      ],
-      "description": "Specifies a subnet for a load balancer."
-    },
-    "LoadBalancerAttribute": {
-      "type": "object",
-      "additionalProperties": false,
-      "properties": {
-        "Value": {
-          "type": "string",
-          "description": "The value of the attribute."
-        },
-        "Key": {
-          "type": "string",
-          "description": "The name of the attribute.\n The following attributes are supported by all load balancers:\n  +   ``deletion_protection.enabled`` - Indicates whether deletion protection is enabled. The value is ``true`` or ``false``. The default is ``false``.\n  +   ``load_balancing.cross_zone.enabled`` - Indicates whether cross-zone load balancing is enabled. The possible values are ``true`` and ``false``. The default for Network Load Balancers and Gateway Load Balancers is ``false``. The default for Application Load Balancers is ``true``, and cannot be changed.\n  \n The following attributes are supported by both Application Load Balancers and Network Load Balancers:\n  +   ``access_logs.s3.enabled`` - Indicates whether access logs are enabled. The value is ``true`` or ``false``. The default is ``false``.\n  +   ``access_logs.s3.bucket`` - The name of the S3 bucket for the access logs. This attribute is required if access logs are enabled. The bucket must exist in the same region as the load balancer and have a bucket policy that grants Elastic Load Balancing permissions to write to the bucket.\n  +   ``access_logs.s3.prefix`` - The prefix for the location in the S3 bucket for the access logs.\n  +   ``ipv6.deny_all_igw_traffic`` - Blocks internet gateway (IGW) access to the load balancer. It is set to ``false`` for internet-facing load balancers and ``true`` for internal load balancers, preventing unintended access to your internal load balancer through an internet gateway.\n  \n The following attributes are supported by only Application Load Balancers:\n  +   ``idle_timeout.timeout_seconds`` - The idle timeout value, in seconds. The valid range is 1-4000 seconds. The default is 60 seconds.\n  +   ``client_keep_alive.seconds`` - The client keep alive value, in seconds. The valid range is 60-604800 seconds. The default is 3600 seconds.\n  +   ``connection_logs.s3.enabled`` - Indicates whether connection logs are enabled. The value is ``true`` or ``false``. The default is ``false``.\n  +   ``connection_logs.s3.bucket`` - The name of the S3 bucket for the connection logs. This attribute is required if connection logs are enabled. The bucket must exist in the same region as the load balancer and have a bucket policy that grants Elastic Load Balancing permissions to write to the bucket.\n  +   ``connection_logs.s3.prefix`` - The prefix for the location in the S3 bucket for the connection logs.\n  +   ``routing.http.desync_mitigation_mode`` - Determines how the load balancer handles requests that might pose a security risk to your application. The possible values are ``monitor``, ``defensive``, and ``strictest``. The default is ``defensive``.\n  +   ``routing.http.drop_invalid_header_fields.enabled`` - Indicates whether HTTP headers with invalid header fields are removed by the load balancer (``true``) or routed to targets (``false``). The default is ``false``.\n  +   ``routing.http.preserve_host_header.enabled`` - Indicates whether the Application Load Balancer should preserve the ``Host`` header in the HTTP request and send it to the target without any change. The possible values are ``true`` and ``false``. The default is ``false``.\n  +   ``routing.http.x_amzn_tls_version_and_cipher_suite.enabled`` - Indicates whether the two headers (``x-amzn-tls-version`` and ``x-amzn-tls-cipher-suite``), which contain information about the negotiated TLS version and cipher suite, are added to the client request before sending it to the target. The ``x-amzn-tls-version`` header has information about the TLS protocol version negotiated with the client, and the ``x-amzn-tls-cipher-suite`` header has information about the cipher suite negotiated with the client. Both headers are in OpenSSL format. The possible values for the attribute are ``true`` and ``false``. The default is ``false``.\n  +   ``routing.http.xff_client_port.enabled`` - Indicates whether the ``X-Forwarded-For`` header should preserve the source port that the client used to connect to the load balancer. The possible values are ``true`` and ``false``. The default is ``false``.\n  +   ``routing.http.xff_header_processing.mode`` - Enables you to modify, preserve, or remove the ``X-Forwarded-For`` header in the HTTP request before the Application Load Balancer sends the request to the target. The possible values are ``append``, ``preserve``, and ``remove``. The default is ``append``.\n  +  If the value is ``append``, the Application Load Balancer adds the client IP address (of the last hop) to the ``X-Forwarded-For`` header in the HTTP request before it sends it to targets.\n  +  If the value is ``preserve`` the Application Load Balancer preserves the ``X-Forwarded-For`` header in the HTTP request, and sends it to targets without any change.\n  +  If the value is ``remove``, the Application Load Balancer removes the ``X-Forwarded-For`` header in the HTTP request before it sends it to targets.\n  \n  +   ``routing.http2.enabled`` - Indicates whether HTTP/2 is enabled. The possible values are ``true`` and ``false``. The default is ``true``. Elastic Load Balancing requires that message header names contain only alphanumeric characters and hyphens.\n  +   ``waf.fail_open.enabled`` - Indicates whether to allow a WAF-enabled load balancer to route requests to targets if it is unable to forward the request to AWS WAF. The possible values are ``true`` and ``false``. The default is ``false``.\n  \n The following attributes are supported by only Network Load Balancers:\n  +   ``dns_record.client_routing_policy`` - Indicates how traffic is distributed among the load balancer Availability Zones. The possible values are ``availability_zone_affinity`` with 100 percent zonal affinity, ``partial_availability_zone_affinity`` with 85 percent zonal affinity, and ``any_availability_zone`` with 0 percent zonal affinity."
-        }
-      },
-      "description": "Specifies an attribute for an Application Load Balancer, a Network Load Balancer, or a Gateway Load Balancer."
-    },
-    "Tag": {
-      "type": "object",
-      "additionalProperties": false,
-      "properties": {
-        "Value": {
-          "type": "string",
-          "description": "The value of the tag."
-        },
-        "Key": {
-          "type": "string",
-          "description": "The key of the tag."
-        }
-      },
-      "required": [
-        "Key"
-      ],
-      "description": "Information about a tag."
-    }
-  },
-  "createOnlyProperties": [
-    "/properties/Name",
-    "/properties/Type",
-    "/properties/Scheme"
-  ],
-  "primaryIdentifier": [
-    "/properties/LoadBalancerArn"
-  ],
-  "readOnlyProperties": [
-    "/properties/LoadBalancerName",
-    "/properties/LoadBalancerFullName",
-    "/properties/CanonicalHostedZoneID",
-    "/properties/LoadBalancerArn",
-    "/properties/DNSName"
-  ],
-  "tagging": {
-    "taggable": true,
-    "tagOnCreate": true,
-    "tagUpdatable": true,
-    "cloudFormationSystemTags": false,
-    "tagProperty": "/properties/Tags"
-  },
-  "handlers": {
-    "create": {
-      "permissions": [
-        "elasticloadbalancing:CreateLoadBalancer",
-        "elasticloadbalancing:DescribeLoadBalancers",
-        "elasticloadbalancing:ModifyLoadBalancerAttributes",
-        "elasticloadbalancing:AddTags"
-      ],
-      "timeoutInMinutes": 30
-    },
-    "delete": {
-      "permissions": [
-        "elasticloadbalancing:DescribeLoadBalancers",
-        "elasticloadbalancing:DeleteLoadBalancer"
-      ]
-    },
-    "list": {
-      "permissions": [
-        "elasticloadbalancing:DescribeLoadBalancers"
-      ]
-    },
-    "read": {
-      "permissions": [
-        "elasticloadbalancing:DescribeLoadBalancers",
-        "elasticloadbalancing:DescribeLoadBalancerAttributes",
-        "elasticloadbalancing:DescribeTags"
-      ]
-    },
-    "update": {
-      "permissions": [
-        "elasticloadbalancing:ModifyLoadBalancerAttributes",
-        "elasticloadbalancing:SetSubnets",
-        "elasticloadbalancing:SetIpAddressType",
-        "elasticloadbalancing:SetSecurityGroups",
-        "elasticloadbalancing:AddTags",
-        "elasticloadbalancing:RemoveTags"
-      ]
     }
   }
 }
diff --git a/internal/aws/cfn/schemas/aws/emrserverless/application.json b/internal/aws/cfn/schemas/aws/emrserverless/application.json
index 41826cd0..4a0109ff 100644
--- a/internal/aws/cfn/schemas/aws/emrserverless/application.json
+++ b/internal/aws/cfn/schemas/aws/emrserverless/application.json
@@ -200,6 +200,10 @@
         "Disk": {
           "description": "Per worker Disk resource. GB is the only supported unit and specifying GB is optional",
           "$ref": "#/definitions/DiskSize"
+        },
+        "DiskType": {
+          "description": "Per worker DiskType resource. Shuffle optimized and Standard are only supported types and specifying diskType is optional",
+          "$ref": "#/definitions/DiskType"
         }
       },
       "required": [
@@ -433,6 +437,11 @@
       "maxLength": 15,
       "pattern": "^[1-9][0-9]*(\\s)?(GB|gb|gB|Gb)$"
     },
+    "DiskType": {
+      "description": "Per worker DiskType resource. Shuffle optimized and Standard are only supported types and specifying diskType is optional",
+      "type": "string",
+      "pattern": "^(SHUFFLE_OPTIMIZED|[Ss]huffle_[Oo]ptimized|STANDARD|[Ss]tandard)$"
+    },
     "WorkerTypeSpecificationInput": {
       "type": "object",
       "description": "The specifications for a worker type.",
@@ -515,7 +524,8 @@
     },
     "Arn": {
       "description": "The Amazon Resource Name (ARN) of the EMR Serverless Application.",
-      "type": "string"
+      "type": "string",
+      "pattern": "^arn:(aws[a-zA-Z0-9-]*):emr-serverless:.+:(\\d{12}):\\/applications\\/[0-9a-zA-Z]+$"
     },
     "ApplicationId": {
       "description": "The ID of the EMR Serverless Application.",
@@ -559,22 +569,32 @@
   ],
   "tagging": {
     "taggable": true,
+    "tagOnCreate": true,
+    "tagUpdatable": true,
     "cloudFormationSystemTags": false,
     "tagProperty": "/properties/Tags"
   },
   "handlers": {
     "create": {
       "permissions": [
-        "kms:Create*",
-        "kms:Describe*",
-        "kms:Enable*",
-        "kms:List*",
-        "kms:Put*",
-        "kms:Update*",
-        "kms:Revoke*",
-        "kms:Disable*",
-        "kms:Get*",
-        "kms:Delete*",
+        "kms:CreateKey",
+        "kms:CreateAlias",
+        "kms:DescribeKey",
+        "kms:EnableKey",
+        "kms:ListGrants",
+        "kms:ListAliases",
+        "kms:ListKeyPolicies",
+        "kms:ListKeys",
+        "kms:PutKeyPolicy",
+        "kms:UpdateKeyDescription",
+        "kms:UpdateAlias",
+        "kms:UpdatePrimaryRegion",
+        "kms:RevokeGrant",
+        "kms:DisableKey",
+        "kms:DisableKeyRotation",
+        "kms:GetKeyPolicy",
+        "kms:GetKeyRotationStatus",
+        "kms:DeleteAlias",
         "kms:ScheduleKeyDeletion",
         "kms:CancelKeyDeletion",
         "kms:GenerateDataKey",
@@ -606,16 +626,24 @@
         "ecr:BatchGetImage",
         "ecr:DescribeImages",
         "ecr:GetDownloadUrlForLayer",
-        "kms:Create*",
-        "kms:Describe*",
-        "kms:Enable*",
-        "kms:List*",
-        "kms:Put*",
-        "kms:Update*",
-        "kms:Revoke*",
-        "kms:Disable*",
-        "kms:Get*",
-        "kms:Delete*",
+        "kms:CreateKey",
+        "kms:CreateAlias",
+        "kms:DescribeKey",
+        "kms:EnableKey",
+        "kms:ListGrants",
+        "kms:ListAliases",
+        "kms:ListKeyPolicies",
+        "kms:ListKeys",
+        "kms:PutKeyPolicy",
+        "kms:UpdateKeyDescription",
+        "kms:UpdateAlias",
+        "kms:UpdatePrimaryRegion",
+        "kms:RevokeGrant",
+        "kms:DisableKey",
+        "kms:DisableKeyRotation",
+        "kms:GetKeyPolicy",
+        "kms:GetKeyRotationStatus",
+        "kms:DeleteAlias",
         "kms:ScheduleKeyDeletion",
         "kms:CancelKeyDeletion",
         "kms:GenerateDataKey",
diff --git a/internal/aws/cfn/schemas/aws/fsx/filesystem.json b/internal/aws/cfn/schemas/aws/fsx/filesystem.json
index 4c22800f..1e417d54 100644
--- a/internal/aws/cfn/schemas/aws/fsx/filesystem.json
+++ b/internal/aws/cfn/schemas/aws/fsx/filesystem.json
@@ -71,62 +71,6 @@
     }
   },
   "definitions": {
-    "OpenZFSConfiguration": {
-      "type": "object",
-      "additionalProperties": false,
-      "properties": {
-        "Options": {
-          "type": "array",
-          "uniqueItems": false,
-          "items": {
-            "type": "string"
-          }
-        },
-        "CopyTagsToVolumes": {
-          "type": "boolean"
-        },
-        "DeploymentType": {
-          "type": "string"
-        },
-        "ThroughputCapacity": {
-          "type": "integer"
-        },
-        "RootVolumeConfiguration": {
-          "$ref": "#/definitions/RootVolumeConfiguration"
-        },
-        "EndpointIpAddressRange": {
-          "type": "string"
-        },
-        "RouteTableIds": {
-          "type": "array",
-          "uniqueItems": false,
-          "items": {
-            "type": "string"
-          }
-        },
-        "WeeklyMaintenanceStartTime": {
-          "type": "string"
-        },
-        "DiskIopsConfiguration": {
-          "$ref": "#/definitions/DiskIopsConfiguration"
-        },
-        "DailyAutomaticBackupStartTime": {
-          "type": "string"
-        },
-        "CopyTagsToBackups": {
-          "type": "boolean"
-        },
-        "AutomaticBackupRetentionDays": {
-          "type": "integer"
-        },
-        "PreferredSubnetId": {
-          "type": "string"
-        }
-      },
-      "required": [
-        "DeploymentType"
-      ]
-    },
     "SelfManagedActiveDirectoryConfiguration": {
       "type": "object",
       "additionalProperties": false,
@@ -174,18 +118,6 @@
         "FileShareAccessAuditLogLevel"
       ]
     },
-    "DiskIopsConfiguration": {
-      "type": "object",
-      "additionalProperties": false,
-      "properties": {
-        "Mode": {
-          "type": "string"
-        },
-        "Iops": {
-          "type": "integer"
-        }
-      }
-    },
     "LustreConfiguration": {
       "type": "object",
       "additionalProperties": false,
@@ -211,6 +143,9 @@
         "WeeklyMaintenanceStartTime": {
           "type": "string"
         },
+        "MetadataConfiguration": {
+          "$ref": "#/definitions/MetadataConfiguration"
+        },
         "DailyAutomaticBackupStartTime": {
           "type": "string"
         },
@@ -228,19 +163,6 @@
         }
       }
     },
-    "NfsExports": {
-      "type": "object",
-      "additionalProperties": false,
-      "properties": {
-        "ClientConfigurations": {
-          "type": "array",
-          "uniqueItems": false,
-          "items": {
-            "$ref": "#/definitions/ClientConfigurations"
-          }
-        }
-      }
-    },
     "OntapConfiguration": {
       "type": "object",
       "additionalProperties": false,
@@ -290,38 +212,6 @@
         "DeploymentType"
       ]
     },
-    "ClientConfigurations": {
-      "type": "object",
-      "additionalProperties": false,
-      "properties": {
-        "Clients": {
-          "type": "string"
-        },
-        "Options": {
-          "type": "array",
-          "uniqueItems": false,
-          "items": {
-            "type": "string"
-          }
-        }
-      }
-    },
-    "Tag": {
-      "type": "object",
-      "additionalProperties": false,
-      "properties": {
-        "Value": {
-          "type": "string"
-        },
-        "Key": {
-          "type": "string"
-        }
-      },
-      "required": [
-        "Value",
-        "Key"
-      ]
-    },
     "RootVolumeConfiguration": {
       "type": "object",
       "additionalProperties": false,
@@ -403,6 +293,131 @@
         "ThroughputCapacity"
       ]
     },
+    "OpenZFSConfiguration": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "Options": {
+          "type": "array",
+          "uniqueItems": false,
+          "items": {
+            "type": "string"
+          }
+        },
+        "CopyTagsToVolumes": {
+          "type": "boolean"
+        },
+        "DeploymentType": {
+          "type": "string"
+        },
+        "ThroughputCapacity": {
+          "type": "integer"
+        },
+        "RootVolumeConfiguration": {
+          "$ref": "#/definitions/RootVolumeConfiguration"
+        },
+        "EndpointIpAddressRange": {
+          "type": "string"
+        },
+        "RouteTableIds": {
+          "type": "array",
+          "uniqueItems": false,
+          "items": {
+            "type": "string"
+          }
+        },
+        "WeeklyMaintenanceStartTime": {
+          "type": "string"
+        },
+        "DiskIopsConfiguration": {
+          "$ref": "#/definitions/DiskIopsConfiguration"
+        },
+        "DailyAutomaticBackupStartTime": {
+          "type": "string"
+        },
+        "CopyTagsToBackups": {
+          "type": "boolean"
+        },
+        "AutomaticBackupRetentionDays": {
+          "type": "integer"
+        },
+        "PreferredSubnetId": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "DeploymentType"
+      ]
+    },
+    "DiskIopsConfiguration": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "Mode": {
+          "type": "string"
+        },
+        "Iops": {
+          "type": "integer"
+        }
+      }
+    },
+    "MetadataConfiguration": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "Mode": {
+          "type": "string"
+        },
+        "Iops": {
+          "type": "integer"
+        }
+      }
+    },
+    "NfsExports": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "ClientConfigurations": {
+          "type": "array",
+          "uniqueItems": false,
+          "items": {
+            "$ref": "#/definitions/ClientConfigurations"
+          }
+        }
+      }
+    },
+    "ClientConfigurations": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "Clients": {
+          "type": "string"
+        },
+        "Options": {
+          "type": "array",
+          "uniqueItems": false,
+          "items": {
+            "type": "string"
+          }
+        }
+      }
+    },
+    "Tag": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "Value": {
+          "type": "string"
+        },
+        "Key": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "Value",
+        "Key"
+      ]
+    },
     "UserAndGroupQuotas": {
       "type": "object",
       "additionalProperties": false,
diff --git a/internal/aws/cfn/schemas/aws/glue/crawler.json b/internal/aws/cfn/schemas/aws/glue/crawler.json
index 7db2ccac..592ff011 100644
--- a/internal/aws/cfn/schemas/aws/glue/crawler.json
+++ b/internal/aws/cfn/schemas/aws/glue/crawler.json
@@ -200,6 +200,13 @@
           "items": {
             "type": "string"
           }
+        },
+        "EnableAdditionalMetadata": {
+          "type": "array",
+          "uniqueItems": false,
+          "items": {
+            "type": "string"
+          }
         }
       }
     },
diff --git a/internal/aws/cfn/schemas/aws/guardduty/filter.json b/internal/aws/cfn/schemas/aws/guardduty/filter.json
index 035fdc62..8021c9be 100644
--- a/internal/aws/cfn/schemas/aws/guardduty/filter.json
+++ b/internal/aws/cfn/schemas/aws/guardduty/filter.json
@@ -140,6 +140,8 @@
     }
   },
   "required": [
+    "DetectorId",
+    "Name",
     "FindingCriteria"
   ],
   "primaryIdentifier": [
diff --git a/internal/aws/cfn/schemas/aws/guardduty/malwareprotectionplan.json b/internal/aws/cfn/schemas/aws/guardduty/malwareprotectionplan.json
new file mode 100644
index 00000000..7b839c49
--- /dev/null
+++ b/internal/aws/cfn/schemas/aws/guardduty/malwareprotectionplan.json
@@ -0,0 +1,182 @@
+{
+  "typeName": "AWS::GuardDuty::MalwareProtectionPlan",
+  "description": "Resource Type definition for AWS::GuardDuty::MalwareProtectionPlan",
+  "additionalProperties": false,
+  "tagging": {
+    "taggable": true,
+    "tagOnCreate": true,
+    "tagUpdatable": true,
+    "cloudFormationSystemTags": false
+  },
+  "properties": {
+    "MalwareProtectionPlanId": {
+      "type": "string",
+      "description": "A unique identifier associated with Malware Protection plan resource."
+    },
+    "Arn": {
+      "type": "string",
+      "description": "Amazon Resource Name (ARN) of the protected resource."
+    },
+    "Role": {
+      "type": "string",
+      "description": "IAM role that includes the permissions required to scan and add tags to the associated protected resource."
+    },
+    "ProtectedResource": {
+      "$ref": "#/definitions/CFNProtectedResource",
+      "description": "Information about the protected resource that is associated with the created Malware Protection plan. Presently, S3Bucket is the only supported protected resource."
+    },
+    "Actions": {
+      "$ref": "#/definitions/CFNActions",
+      "description": "Information about whether the tags will be added to the S3 object after scanning."
+    },
+    "CreatedAt": {
+      "type": "string",
+      "description": "The timestamp when the Malware Protection plan resource was created."
+    },
+    "Status": {
+      "type": "string",
+      "description": "Malware Protection plan status."
+    },
+    "StatusReasons": {
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/CFNStatusReasons"
+      },
+      "description": "Information about the issue code and message associated to the status of your Malware Protection plan."
+    },
+    "Tags": {
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/TagItem"
+      }
+    }
+  },
+  "required": [
+    "Role",
+    "ProtectedResource"
+  ],
+  "definitions": {
+    "TagItem": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "Key": {
+          "type": "string"
+        },
+        "Value": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "Key",
+        "Value"
+      ]
+    },
+    "CFNProtectedResource": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "S3Bucket": {
+          "type": "object",
+          "description": "Information about the protected S3 bucket resource.",
+          "additionalProperties": false,
+          "properties": {
+            "BucketName": {
+              "type": "string",
+              "description": "Name of the S3 bucket."
+            },
+            "ObjectPrefixes": {
+              "type": "array",
+              "description": "Information about the specified object prefixes. The S3 object will be scanned only if it belongs to any of the specified object prefixes.",
+              "items": {
+                "type": "string"
+              }
+            }
+          }
+        }
+      },
+      "required": [
+        "S3Bucket"
+      ]
+    },
+    "CFNActions": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "Tagging": {
+          "$ref": "#/definitions/CFNTagging",
+          "description": "Indicates whether the scanned S3 object will have tags about the scan result."
+        }
+      }
+    },
+    "CFNTagging": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "Status": {
+          "type": "string",
+          "description": "Indicates whether or not the tags will added."
+        }
+      }
+    },
+    "CFNStatusReasons": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "Code": {
+          "type": "string",
+          "description": "Issue code."
+        },
+        "Message": {
+          "type": "string",
+          "description": "Issue message that specifies the reason."
+        }
+      }
+    }
+  },
+  "primaryIdentifier": [
+    "/properties/MalwareProtectionPlanId"
+  ],
+  "readOnlyProperties": [
+    "/properties/MalwareProtectionPlanId",
+    "/properties/Arn",
+    "/properties/CreatedAt",
+    "/properties/Status",
+    "/properties/StatusReasons"
+  ],
+  "handlers": {
+    "create": {
+      "permissions": [
+        "guardduty:CreateMalwareProtectionPlan",
+        "guardduty:GetMalwareProtectionPlan",
+        "guardduty:TagResource",
+        "iam:PassRole"
+      ]
+    },
+    "read": {
+      "permissions": [
+        "guardduty:GetMalwareProtectionPlan"
+      ]
+    },
+    "delete": {
+      "permissions": [
+        "guardduty:DeleteMalwareProtectionPlan",
+        "guardduty:GetMalwareProtectionPlan"
+      ]
+    },
+    "update": {
+      "permissions": [
+        "guardduty:UpdateMalwareProtectionPlan",
+        "guardduty:GetMalwareProtectionPlan",
+        "guardduty:TagResource",
+        "guardduty:UntagResource",
+        "iam:PassRole"
+      ]
+    },
+    "list": {
+      "permissions": [
+        "guardduty:ListMalwareProtectionPlans"
+      ]
+    }
+  }
+}
diff --git a/internal/aws/cfn/schemas/aws/imagebuilder/component.json b/internal/aws/cfn/schemas/aws/imagebuilder/component.json
index 2e818bc1..32d4ace3 100644
--- a/internal/aws/cfn/schemas/aws/imagebuilder/component.json
+++ b/internal/aws/cfn/schemas/aws/imagebuilder/component.json
@@ -127,7 +127,10 @@
       "permissions": [
         "iam:CreateServiceLinkedRole",
         "iam:GetRole",
-        "kms:GenerateDataKey*",
+        "kms:GenerateDataKey",
+        "kms:GenerateDataKeyPair",
+        "kms:GenerateDataKeyPairWithoutPlaintext",
+        "kms:GenerateDataKeyWithoutPlaintext",
         "kms:Encrypt",
         "kms:Decrypt",
         "s3:GetObject",
diff --git a/internal/aws/cfn/schemas/aws/imagebuilder/containerrecipe.json b/internal/aws/cfn/schemas/aws/imagebuilder/containerrecipe.json
index bfc9471a..c4c8f995 100644
--- a/internal/aws/cfn/schemas/aws/imagebuilder/containerrecipe.json
+++ b/internal/aws/cfn/schemas/aws/imagebuilder/containerrecipe.json
@@ -312,7 +312,10 @@
         "kms:Decrypt",
         "kms:ReEncryptFrom",
         "kms:ReEncryptTo",
-        "kms:GenerateDataKey*",
+        "kms:GenerateDataKey",
+        "kms:GenerateDataKeyPair",
+        "kms:GenerateDataKeyPairWithoutPlaintext",
+        "kms:GenerateDataKeyWithoutPlaintext",
         "s3:GetObject",
         "s3:ListBucket",
         "ecr:DescribeRepositories",
diff --git a/internal/aws/cfn/schemas/aws/imagebuilder/workflow.json b/internal/aws/cfn/schemas/aws/imagebuilder/workflow.json
index d97a90da..77799ace 100644
--- a/internal/aws/cfn/schemas/aws/imagebuilder/workflow.json
+++ b/internal/aws/cfn/schemas/aws/imagebuilder/workflow.json
@@ -103,7 +103,10 @@
     "create": {
       "permissions": [
         "iam:GetRole",
-        "kms:GenerateDataKey*",
+        "kms:GenerateDataKey",
+        "kms:GenerateDataKeyPair",
+        "kms:GenerateDataKeyPairWithoutPlaintext",
+        "kms:GenerateDataKeyWithoutPlaintext",
         "kms:Encrypt",
         "kms:Decrypt",
         "s3:GetObject",
diff --git a/internal/aws/cfn/schemas/aws/kinesisanalyticsv2/application.json b/internal/aws/cfn/schemas/aws/kinesisanalyticsv2/application.json
index 27505fb6..9719153a 100644
--- a/internal/aws/cfn/schemas/aws/kinesisanalyticsv2/application.json
+++ b/internal/aws/cfn/schemas/aws/kinesisanalyticsv2/application.json
@@ -85,6 +85,10 @@
           "description": "Describes whether snapshots are enabled for a Flink-based Kinesis Data Analytics application.",
           "$ref": "#/definitions/ApplicationSnapshotConfiguration"
         },
+        "ApplicationSystemRollbackConfiguration": {
+          "description": "Describes whether system initiated rollbacks are enabled for a Flink-based Kinesis Data Analytics application.",
+          "$ref": "#/definitions/ApplicationSystemRollbackConfiguration"
+        },
         "EnvironmentProperties": {
           "description": "Describes execution properties for a Flink-based Kinesis Data Analytics application.",
           "$ref": "#/definitions/EnvironmentProperties"
@@ -244,6 +248,20 @@
         "SnapshotsEnabled"
       ]
     },
+    "ApplicationSystemRollbackConfiguration": {
+      "description": "Describes whether system initiated rollbacks are enabled for a Flink-based Kinesis Data Analytics application.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "RollbackEnabled": {
+          "description": "Describes whether system initiated rollbacks are enabled for a Flink-based Kinesis Data Analytics application.",
+          "type": "boolean"
+        }
+      },
+      "required": [
+        "RollbackEnabled"
+      ]
+    },
     "EnvironmentProperties": {
       "description": "Describes execution properties for a Flink-based Kinesis Data Analytics application.",
       "type": "object",
diff --git a/internal/aws/cfn/schemas/aws/kinesisfirehose/deliverystream.json b/internal/aws/cfn/schemas/aws/kinesisfirehose/deliverystream.json
index 27462eef..635a7b14 100644
--- a/internal/aws/cfn/schemas/aws/kinesisfirehose/deliverystream.json
+++ b/internal/aws/cfn/schemas/aws/kinesisfirehose/deliverystream.json
@@ -74,7 +74,11 @@
           "type": "string",
           "minLength": 1,
           "maxLength": 512,
-          "pattern": "arn:.*"
+          "pattern": "arn:.*",
+          "relationshipRef": {
+            "typeName": "AWS::KMS::Key",
+            "propertyPath": "/properties/Arn"
+          }
         },
         "KeyType": {
           "type": "string",
@@ -129,6 +133,9 @@
         "S3Configuration": {
           "$ref": "#/definitions/S3DestinationConfiguration"
         },
+        "SecretsManagerConfiguration": {
+          "$ref": "#/definitions/SecretsManagerConfiguration"
+        },
         "BufferingHints": {
           "$ref": "#/definitions/SplunkBufferingHints"
         }
@@ -136,7 +143,6 @@
       "required": [
         "HECEndpoint",
         "S3Configuration",
-        "HECToken",
         "HECEndpointType"
       ]
     },
@@ -148,7 +154,11 @@
           "type": "string",
           "minLength": 1,
           "maxLength": 512,
-          "pattern": "arn:.*"
+          "pattern": "arn:.*",
+          "relationshipRef": {
+            "typeName": "AWS::IAM::Role",
+            "propertyPath": "/properties/Arn"
+          }
         },
         "EndpointConfiguration": {
           "$ref": "#/definitions/HttpEndpointConfiguration"
@@ -173,6 +183,9 @@
         },
         "S3Configuration": {
           "$ref": "#/definitions/S3DestinationConfiguration"
+        },
+        "SecretsManagerConfiguration": {
+          "$ref": "#/definitions/SecretsManagerConfiguration"
         }
       },
       "required": [
@@ -188,13 +201,21 @@
           "type": "string",
           "minLength": 1,
           "maxLength": 512,
-          "pattern": "arn:.*"
+          "pattern": "arn:.*",
+          "relationshipRef": {
+            "typeName": "AWS::Kinesis::Stream",
+            "propertyPath": "/properties/Arn"
+          }
         },
         "RoleARN": {
           "type": "string",
           "minLength": 1,
           "maxLength": 512,
-          "pattern": "arn:.*"
+          "pattern": "arn:.*",
+          "relationshipRef": {
+            "typeName": "AWS::IAM::Role",
+            "propertyPath": "/properties/Arn"
+          }
         }
       },
       "required": [
@@ -210,7 +231,11 @@
           "type": "string",
           "minLength": 1,
           "maxLength": 512,
-          "pattern": "arn:.*"
+          "pattern": "arn:.*",
+          "relationshipRef": {
+            "typeName": "AWS::MSK::Cluster",
+            "propertyPath": "/properties/Arn"
+          }
         },
         "TopicName": {
           "type": "string",
@@ -236,7 +261,11 @@
           "type": "string",
           "minLength": 1,
           "maxLength": 512,
-          "pattern": "arn:.*"
+          "pattern": "arn:.*",
+          "relationshipRef": {
+            "typeName": "AWS::IAM::Role",
+            "propertyPath": "/properties/Arn"
+          }
         },
         "Connectivity": {
           "type": "string",
@@ -259,7 +288,11 @@
           "type": "string",
           "minLength": 1,
           "maxLength": 512,
-          "pattern": "arn:.*"
+          "pattern": "arn:.*",
+          "relationshipRef": {
+            "typeName": "AWS::IAM::Role",
+            "propertyPath": "/properties/Arn"
+          }
         },
         "SubnetIds": {
           "type": "array",
@@ -267,7 +300,11 @@
           "items": {
             "type": "string",
             "minLength": 1,
-            "maxLength": 1024
+            "maxLength": 1024,
+            "relationshipRef": {
+              "typeName": "AWS::EC2::Subnet",
+              "propertyPath": "/properties/SubnetId"
+            }
           },
           "minItems": 1,
           "maxItems": 16
@@ -278,7 +315,11 @@
           "items": {
             "type": "string",
             "minLength": 1,
-            "maxLength": 1024
+            "maxLength": 1024,
+            "relationshipRef": {
+              "typeName": "AWS::EC2::SecurityGroup",
+              "propertyPath": "/properties/GroupId"
+            }
           },
           "minItems": 1,
           "maxItems": 5
@@ -314,7 +355,11 @@
           "type": "string",
           "minLength": 1,
           "maxLength": 2048,
-          "pattern": "arn:.*"
+          "pattern": "arn:.*",
+          "relationshipRef": {
+            "typeName": "AWS::S3::Bucket",
+            "propertyPath": "/properties/Arn"
+          }
         },
         "BufferingHints": {
           "$ref": "#/definitions/BufferingHints"
@@ -369,7 +414,11 @@
           "type": "string",
           "minLength": 1,
           "maxLength": 512,
-          "pattern": "arn:.*"
+          "pattern": "arn:.*",
+          "relationshipRef": {
+            "typeName": "AWS::IAM::Role",
+            "propertyPath": "/properties/Arn"
+          }
         },
         "S3BackupConfiguration": {
           "$ref": "#/definitions/S3DestinationConfiguration"
@@ -395,7 +444,11 @@
           "type": "string",
           "minLength": 1,
           "maxLength": 2048,
-          "pattern": "arn:.*"
+          "pattern": "arn:.*",
+          "relationshipRef": {
+            "typeName": "AWS::S3::Bucket",
+            "propertyPath": "/properties/Arn"
+          }
         },
         "BufferingHints": {
           "$ref": "#/definitions/BufferingHints"
@@ -430,7 +483,11 @@
           "type": "string",
           "minLength": 1,
           "maxLength": 512,
-          "pattern": "arn:.*"
+          "pattern": "arn:.*",
+          "relationshipRef": {
+            "typeName": "AWS::IAM::Role",
+            "propertyPath": "/properties/Arn"
+          }
         }
       },
       "required": [
@@ -468,7 +525,11 @@
           "type": "string",
           "minLength": 1,
           "maxLength": 512,
-          "pattern": "arn:.*"
+          "pattern": "arn:.*",
+          "relationshipRef": {
+            "typeName": "AWS::IAM::Role",
+            "propertyPath": "/properties/Arn"
+          }
         },
         "S3BackupConfiguration": {
           "$ref": "#/definitions/S3DestinationConfiguration"
@@ -483,6 +544,9 @@
         "S3Configuration": {
           "$ref": "#/definitions/S3DestinationConfiguration"
         },
+        "SecretsManagerConfiguration": {
+          "$ref": "#/definitions/SecretsManagerConfiguration"
+        },
         "Username": {
           "type": "string",
           "minLength": 1,
@@ -491,11 +555,9 @@
       },
       "required": [
         "S3Configuration",
-        "Username",
         "ClusterJDBCURL",
         "CopyCommand",
-        "RoleARN",
-        "Password"
+        "RoleARN"
       ]
     },
     "ElasticsearchDestinationConfiguration": {
@@ -512,7 +574,21 @@
           "type": "string",
           "minLength": 1,
           "maxLength": 512,
-          "pattern": "arn:.*"
+          "pattern": "arn:.*",
+          "anyOf": [
+            {
+              "relationshipRef": {
+                "typeName": "AWS::Elasticsearch::Domain",
+                "propertyPath": "/properties/Arn"
+              }
+            },
+            {
+              "relationshipRef": {
+                "typeName": "AWS::OpenSearchService::Domain",
+                "propertyPath": "/properties/Arn"
+              }
+            }
+          ]
         },
         "IndexName": {
           "type": "string",
@@ -539,7 +615,11 @@
           "type": "string",
           "minLength": 1,
           "maxLength": 512,
-          "pattern": "arn:.*"
+          "pattern": "arn:.*",
+          "relationshipRef": {
+            "typeName": "AWS::IAM::Role",
+            "propertyPath": "/properties/Arn"
+          }
         },
         "S3BackupMode": {
           "type": "string",
@@ -616,7 +696,11 @@
           "type": "string",
           "minLength": 1,
           "maxLength": 512,
-          "pattern": "arn:.*"
+          "pattern": "arn:.*",
+          "relationshipRef": {
+            "typeName": "AWS::IAM::Role",
+            "propertyPath": "/properties/Arn"
+          }
         },
         "S3BackupMode": {
           "type": "string",
@@ -677,7 +761,11 @@
           "type": "string",
           "minLength": 1,
           "maxLength": 512,
-          "pattern": "arn:.*"
+          "pattern": "arn:.*",
+          "relationshipRef": {
+            "typeName": "AWS::IAM::Role",
+            "propertyPath": "/properties/Arn"
+          }
         },
         "S3BackupMode": {
           "type": "string",
@@ -693,7 +781,11 @@
           "type": "string",
           "minLength": 1,
           "maxLength": 512,
-          "pattern": "https:.*"
+          "pattern": "https:.*",
+          "relationshipRef": {
+            "typeName": "AWS::OpenSearchServerless::Collection",
+            "propertyPath": "/properties/CollectionEndpoint"
+          }
         },
         "VpcConfiguration": {
           "$ref": "#/definitions/VpcConfiguration"
@@ -780,7 +872,11 @@
           "type": "string",
           "minLength": 1,
           "maxLength": 512,
-          "pattern": "arn:.*"
+          "pattern": "arn:.*",
+          "relationshipRef": {
+            "typeName": "AWS::IAM::Role",
+            "propertyPath": "/properties/Arn"
+          }
         },
         "RetryOptions": {
           "$ref": "#/definitions/SnowflakeRetryOptions"
@@ -794,12 +890,13 @@
         },
         "S3Configuration": {
           "$ref": "#/definitions/S3DestinationConfiguration"
+        },
+        "SecretsManagerConfiguration": {
+          "$ref": "#/definitions/SecretsManagerConfiguration"
         }
       },
       "required": [
         "AccountUrl",
-        "PrivateKey",
-        "User",
         "Database",
         "Schema",
         "Table",
@@ -1023,10 +1120,18 @@
           "type": "boolean"
         },
         "LogGroupName": {
-          "type": "string"
+          "type": "string",
+          "relationshipRef": {
+            "typeName": "AWS::Logs::LogGroup",
+            "propertyPath": "/properties/LogGroupName"
+          }
         },
         "LogStreamName": {
-          "type": "string"
+          "type": "string",
+          "relationshipRef": {
+            "typeName": "AWS::Logs::LogStream",
+            "propertyPath": "/properties/LogStreamName"
+          }
         }
       }
     },
@@ -1071,7 +1176,11 @@
       "additionalProperties": false,
       "properties": {
         "AWSKMSKeyARN": {
-          "type": "string"
+          "type": "string",
+          "relationshipRef": {
+            "typeName": "AWS::KMS::Key",
+            "propertyPath": "/properties/Arn"
+          }
         }
       },
       "required": [
@@ -1095,7 +1204,11 @@
           "type": "string"
         },
         "DatabaseName": {
-          "type": "string"
+          "type": "string",
+          "relationshipRef": {
+            "typeName": "AWS::Glue::Database",
+            "propertyPath": "/properties/Id"
+          }
         },
         "Region": {
           "type": "string"
@@ -1104,10 +1217,18 @@
           "type": "string",
           "minLength": 1,
           "maxLength": 512,
-          "pattern": "arn:.*"
+          "pattern": "arn:.*",
+          "relationshipRef": {
+            "typeName": "AWS::IAM::Role",
+            "propertyPath": "/properties/Arn"
+          }
         },
         "TableName": {
-          "type": "string"
+          "type": "string",
+          "relationshipRef": {
+            "typeName": "AWS::Glue::Table",
+            "propertyPath": "/properties/Id"
+          }
         },
         "VersionId": {
           "type": "string"
@@ -1134,7 +1255,27 @@
           "type": "string"
         },
         "ParameterValue": {
-          "type": "string"
+          "type": "string",
+          "anyOf": [
+            {
+              "relationshipRef": {
+                "typeName": "AWS::Lambda::Function",
+                "propertyPath": "/properties/Arn"
+              }
+            },
+            {
+              "relationshipRef": {
+                "typeName": "AWS::IAM::Role",
+                "propertyPath": "/properties/Arn"
+              }
+            },
+            {
+              "relationshipRef": {
+                "typeName": "AWS::Lambda::Alias",
+                "propertyPath": "/properties/Id"
+              }
+            }
+          ]
         }
       },
       "required": [
@@ -1347,6 +1488,38 @@
         "PrivateLinkVpceId"
       ]
     },
+    "SecretsManagerConfiguration": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "Enabled": {
+          "type": "boolean"
+        },
+        "RoleARN": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 512,
+          "pattern": "arn:.*",
+          "relationshipRef": {
+            "typeName": "AWS::IAM::Role",
+            "propertyPath": "/properties/Arn"
+          }
+        },
+        "SecretARN": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 512,
+          "pattern": "arn:.*",
+          "relationshipRef": {
+            "typeName": "AWS::SecretsManager::Secret",
+            "propertyPath": "/properties/Arn"
+          }
+        }
+      },
+      "required": [
+        "Enabled"
+      ]
+    },
     "Tag": {
       "type": "object",
       "additionalProperties": false,
diff --git a/internal/aws/cfn/schemas/aws/kms/key.json b/internal/aws/cfn/schemas/aws/kms/key.json
index a497e36e..6ef26925 100644
--- a/internal/aws/cfn/schemas/aws/kms/key.json
+++ b/internal/aws/cfn/schemas/aws/kms/key.json
@@ -57,7 +57,8 @@
       "enum": [
         "ENCRYPT_DECRYPT",
         "SIGN_VERIFY",
-        "GENERATE_VERIFY_MAC"
+        "GENERATE_VERIFY_MAC",
+        "KEY_AGREEMENT"
       ]
     },
     "Origin": {
diff --git a/internal/aws/cfn/schemas/aws/location/map.json b/internal/aws/cfn/schemas/aws/location/map.json
index f48edf7c..622d7a6b 100644
--- a/internal/aws/cfn/schemas/aws/location/map.json
+++ b/internal/aws/cfn/schemas/aws/location/map.json
@@ -43,11 +43,11 @@
       "type": "object",
       "maxProperties": 50,
       "patternProperties": {
-        "^[a-zA-Z+-=._:/]+$": {
+        "^([\\p{L}\\p{Z}\\p{N}_.,:/=+\\-@]*)$": {
           "type": "string",
           "maxLength": 256,
           "minLength": 0,
-          "pattern": "^[A-Za-z0-9 _=@:.+-/]*$"
+          "pattern": "^([\\p{L}\\p{Z}\\p{N}_.,:/=+\\-@]*)$"
         }
       },
       "additionalProperties": false
diff --git a/internal/aws/cfn/schemas/aws/mediapackage/asset.json b/internal/aws/cfn/schemas/aws/mediapackage/asset.json
index 04b994d9..c06db6fb 100644
--- a/internal/aws/cfn/schemas/aws/mediapackage/asset.json
+++ b/internal/aws/cfn/schemas/aws/mediapackage/asset.json
@@ -84,6 +84,13 @@
       ]
     }
   },
+  "tagging": {
+    "taggable": true,
+    "tagOnCreate": true,
+    "tagUpdatable": false,
+    "cloudFormationSystemTags": false,
+    "tagProperty": "/properties/Tags"
+  },
   "additionalProperties": false,
   "required": [
     "Id",
diff --git a/internal/aws/cfn/schemas/aws/mediapackage/channel.json b/internal/aws/cfn/schemas/aws/mediapackage/channel.json
index 369fd707..2062f881 100644
--- a/internal/aws/cfn/schemas/aws/mediapackage/channel.json
+++ b/internal/aws/cfn/schemas/aws/mediapackage/channel.json
@@ -113,6 +113,13 @@
       }
     }
   },
+  "tagging": {
+    "taggable": true,
+    "tagOnCreate": true,
+    "tagUpdatable": false,
+    "cloudFormationSystemTags": false,
+    "tagProperty": "/properties/Tags"
+  },
   "additionalProperties": false,
   "required": [
     "Id"
diff --git a/internal/aws/cfn/schemas/aws/mediapackage/originendpoint.json b/internal/aws/cfn/schemas/aws/mediapackage/originendpoint.json
index c36b9edd..f89c5d46 100644
--- a/internal/aws/cfn/schemas/aws/mediapackage/originendpoint.json
+++ b/internal/aws/cfn/schemas/aws/mediapackage/originendpoint.json
@@ -627,33 +627,18 @@
       ]
     }
   },
+  "tagging": {
+    "taggable": true,
+    "tagOnCreate": true,
+    "tagUpdatable": false,
+    "cloudFormationSystemTags": false,
+    "tagProperty": "/properties/Tags"
+  },
   "additionalProperties": false,
   "required": [
     "Id",
     "ChannelId"
   ],
-  "oneOf": [
-    {
-      "required": [
-        "HlsPackage"
-      ]
-    },
-    {
-      "required": [
-        "DashPackage"
-      ]
-    },
-    {
-      "required": [
-        "MssPackage"
-      ]
-    },
-    {
-      "required": [
-        "CmafPackage"
-      ]
-    }
-  ],
   "readOnlyProperties": [
     "/properties/Arn",
     "/properties/Url"
diff --git a/internal/aws/cfn/schemas/aws/mediapackage/packagingconfiguration.json b/internal/aws/cfn/schemas/aws/mediapackage/packagingconfiguration.json
index dfc8b43c..9977209a 100644
--- a/internal/aws/cfn/schemas/aws/mediapackage/packagingconfiguration.json
+++ b/internal/aws/cfn/schemas/aws/mediapackage/packagingconfiguration.json
@@ -444,33 +444,18 @@
       ]
     }
   },
+  "tagging": {
+    "taggable": true,
+    "tagOnCreate": true,
+    "tagUpdatable": false,
+    "cloudFormationSystemTags": false,
+    "tagProperty": "/properties/Tags"
+  },
   "additionalProperties": false,
   "required": [
     "PackagingGroupId",
     "Id"
   ],
-  "oneOf": [
-    {
-      "required": [
-        "HlsPackage"
-      ]
-    },
-    {
-      "required": [
-        "DashPackage"
-      ]
-    },
-    {
-      "required": [
-        "MssPackage"
-      ]
-    },
-    {
-      "required": [
-        "CmafPackage"
-      ]
-    }
-  ],
   "readOnlyProperties": [
     "/properties/Arn"
   ],
diff --git a/internal/aws/cfn/schemas/aws/mediapackage/packaginggroup.json b/internal/aws/cfn/schemas/aws/mediapackage/packaginggroup.json
index 38dea6f9..23878505 100644
--- a/internal/aws/cfn/schemas/aws/mediapackage/packaginggroup.json
+++ b/internal/aws/cfn/schemas/aws/mediapackage/packaginggroup.json
@@ -84,6 +84,13 @@
       }
     }
   },
+  "tagging": {
+    "taggable": true,
+    "tagOnCreate": true,
+    "tagUpdatable": false,
+    "cloudFormationSystemTags": false,
+    "tagProperty": "/properties/Tags"
+  },
   "additionalProperties": false,
   "required": [
     "Id"
diff --git a/internal/aws/cfn/schemas/aws/mediapackagev2/channel.json b/internal/aws/cfn/schemas/aws/mediapackagev2/channel.json
index c59570ce..3ba9ed82 100644
--- a/internal/aws/cfn/schemas/aws/mediapackagev2/channel.json
+++ b/internal/aws/cfn/schemas/aws/mediapackagev2/channel.json
@@ -70,6 +70,12 @@
       "description": "<p>The date and time the channel was modified.</p>",
       "format": "date-time"
     },
+    "IngestEndpointUrls": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
     "Tags": {
       "type": "array",
       "insertionOrder": false,
@@ -82,6 +88,7 @@
     "/properties/Arn",
     "/properties/CreatedAt",
     "/properties/IngestEndpoints",
+    "/properties/IngestEndpointUrls",
     "/properties/ModifiedAt"
   ],
   "createOnlyProperties": [
diff --git a/internal/aws/cfn/schemas/aws/mediapackagev2/originendpoint.json b/internal/aws/cfn/schemas/aws/mediapackagev2/originendpoint.json
index ea1eb78d..14b7eba8 100644
--- a/internal/aws/cfn/schemas/aws/mediapackagev2/originendpoint.json
+++ b/internal/aws/cfn/schemas/aws/mediapackagev2/originendpoint.json
@@ -566,6 +566,24 @@
       "minimum": 60,
       "description": "<p>The size of the window (in seconds) to create a window of the live stream that's available for on-demand viewing. Viewers can start-over or catch-up on content that falls within the window. The maximum startover window is 1,209,600 seconds (14 days).</p>"
     },
+    "DashManifestUrls": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "HlsManifestUrls": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "LowLatencyHlsManifestUrls": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
     "Tags": {
       "type": "array",
       "insertionOrder": false,
@@ -582,6 +600,9 @@
   "readOnlyProperties": [
     "/properties/Arn",
     "/properties/CreatedAt",
+    "/properties/DashManifestUrls",
+    "/properties/HlsManifestUrls",
+    "/properties/LowLatencyHlsManifestUrls",
     "/properties/ModifiedAt",
     "/properties/LowLatencyHlsManifests/*/Url",
     "/properties/HlsManifests/*/Url"
diff --git a/internal/aws/cfn/schemas/aws/networkfirewall/firewall.json b/internal/aws/cfn/schemas/aws/networkfirewall/firewall.json
index cc033cbd..6d296024 100644
--- a/internal/aws/cfn/schemas/aws/networkfirewall/firewall.json
+++ b/internal/aws/cfn/schemas/aws/networkfirewall/firewall.json
@@ -158,7 +158,7 @@
     "read": {
       "permissions": [
         "network-firewall:DescribeFirewall",
-        "network-firewall:ListTagsForResources"
+        "network-firewall:ListTagsForResource"
       ]
     },
     "update": {
diff --git a/internal/aws/cfn/schemas/aws/networkfirewall/loggingconfiguration.json b/internal/aws/cfn/schemas/aws/networkfirewall/loggingconfiguration.json
index 7939d5c0..028256d0 100644
--- a/internal/aws/cfn/schemas/aws/networkfirewall/loggingconfiguration.json
+++ b/internal/aws/cfn/schemas/aws/networkfirewall/loggingconfiguration.json
@@ -146,13 +146,6 @@
         "network-firewall:UpdateLoggingConfiguration",
         "network-firewall:DescribeLoggingConfiguration"
       ]
-    },
-    "list": {
-      "permissions": [
-        "logs:GetLogDelivery",
-        "logs:ListLogDeliveries",
-        "network-firewall:DescribeLoggingConfiguration"
-      ]
     }
   }
 }
diff --git a/internal/aws/cfn/schemas/aws/osis/pipeline.json b/internal/aws/cfn/schemas/aws/osis/pipeline.json
index ca086ff7..db48cf4c 100644
--- a/internal/aws/cfn/schemas/aws/osis/pipeline.json
+++ b/internal/aws/cfn/schemas/aws/osis/pipeline.json
@@ -106,6 +106,14 @@
             "maxLength": 24,
             "pattern": "subnet-\\w{8}(\\w{9})?"
           }
+        },
+        "VpcEndpointManagement": {
+          "description": "Defines whether you or Amazon OpenSearch Ingestion service create and manage the VPC endpoint configured for the pipeline.",
+          "type": "string",
+          "enum": [
+            "CUSTOMER",
+            "SERVICE"
+          ]
         }
       },
       "required": [
@@ -187,6 +195,12 @@
         "$ref": "#/definitions/VpcEndpoint"
       }
     },
+    "VpcEndpointService": {
+      "description": "The VPC endpoint service name for the pipeline.",
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128
+    },
     "PipelineArn": {
       "description": "The Amazon Resource Name (ARN) of the pipeline.",
       "type": "string",
@@ -213,7 +227,8 @@
   "readOnlyProperties": [
     "/properties/PipelineArn",
     "/properties/IngestEndpointUrls",
-    "/properties/VpcEndpoints"
+    "/properties/VpcEndpoints",
+    "/properties/VpcEndpointService"
   ],
   "writeOnlyProperties": [
     "/properties/VpcOptions"
diff --git a/internal/aws/cfn/schemas/aws/pipes/pipe.json b/internal/aws/cfn/schemas/aws/pipes/pipe.json
index 4c7790c2..f3f50c42 100644
--- a/internal/aws/cfn/schemas/aws/pipes/pipe.json
+++ b/internal/aws/cfn/schemas/aws/pipes/pipe.json
@@ -208,6 +208,36 @@
       },
       "additionalProperties": false
     },
+    "DimensionMapping": {
+      "type": "object",
+      "properties": {
+        "DimensionValue": {
+          "type": "string",
+          "maxLength": 2048,
+          "minLength": 1
+        },
+        "DimensionValueType": {
+          "$ref": "#/definitions/DimensionValueType"
+        },
+        "DimensionName": {
+          "type": "string",
+          "maxLength": 256,
+          "minLength": 1
+        }
+      },
+      "required": [
+        "DimensionName",
+        "DimensionValue",
+        "DimensionValueType"
+      ],
+      "additionalProperties": false
+    },
+    "DimensionValueType": {
+      "type": "string",
+      "enum": [
+        "VARCHAR"
+      ]
+    },
     "DynamoDBStreamStartPosition": {
       "type": "string",
       "enum": [
@@ -380,6 +410,15 @@
       },
       "additionalProperties": false
     },
+    "EpochTimeUnit": {
+      "type": "string",
+      "enum": [
+        "MILLISECONDS",
+        "SECONDS",
+        "MICROSECONDS",
+        "NANOSECONDS"
+      ]
+    },
     "Filter": {
       "type": "object",
       "properties": {
@@ -526,6 +565,63 @@
         "LATEST"
       ]
     },
+    "MeasureValueType": {
+      "type": "string",
+      "enum": [
+        "DOUBLE",
+        "BIGINT",
+        "VARCHAR",
+        "BOOLEAN",
+        "TIMESTAMP"
+      ]
+    },
+    "MultiMeasureAttributeMapping": {
+      "type": "object",
+      "properties": {
+        "MeasureValue": {
+          "type": "string",
+          "maxLength": 2048,
+          "minLength": 1
+        },
+        "MeasureValueType": {
+          "$ref": "#/definitions/MeasureValueType"
+        },
+        "MultiMeasureAttributeName": {
+          "type": "string",
+          "maxLength": 256,
+          "minLength": 1
+        }
+      },
+      "required": [
+        "MeasureValue",
+        "MeasureValueType",
+        "MultiMeasureAttributeName"
+      ],
+      "additionalProperties": false
+    },
+    "MultiMeasureMapping": {
+      "type": "object",
+      "properties": {
+        "MultiMeasureName": {
+          "type": "string",
+          "maxLength": 256,
+          "minLength": 1
+        },
+        "MultiMeasureAttributeMappings": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/MultiMeasureAttributeMapping"
+          },
+          "maxItems": 256,
+          "minItems": 1
+        }
+      },
+      "required": [
+        "MultiMeasureAttributeMappings",
+        "MultiMeasureName"
+      ],
+      "additionalProperties": false
+    },
     "NetworkConfiguration": {
       "type": "object",
       "properties": {
@@ -1176,6 +1272,9 @@
         },
         "CloudWatchLogsParameters": {
           "$ref": "#/definitions/PipeTargetCloudWatchLogsParameters"
+        },
+        "TimestreamParameters": {
+          "$ref": "#/definitions/PipeTargetTimestreamParameters"
         }
       },
       "additionalProperties": false
@@ -1270,6 +1369,62 @@
       },
       "additionalProperties": false
     },
+    "PipeTargetTimestreamParameters": {
+      "type": "object",
+      "properties": {
+        "TimeValue": {
+          "type": "string",
+          "maxLength": 256,
+          "minLength": 1
+        },
+        "EpochTimeUnit": {
+          "$ref": "#/definitions/EpochTimeUnit"
+        },
+        "TimeFieldType": {
+          "$ref": "#/definitions/TimeFieldType"
+        },
+        "TimestampFormat": {
+          "type": "string",
+          "maxLength": 256,
+          "minLength": 1
+        },
+        "VersionValue": {
+          "type": "string",
+          "maxLength": 256,
+          "minLength": 1
+        },
+        "DimensionMappings": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/DimensionMapping"
+          },
+          "maxItems": 128,
+          "minItems": 1
+        },
+        "SingleMeasureMappings": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/SingleMeasureMapping"
+          },
+          "maxItems": 8192,
+          "minItems": 0
+        },
+        "MultiMeasureMappings": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/MultiMeasureMapping"
+          },
+          "maxItems": 1024,
+          "minItems": 0
+        }
+      },
+      "required": [
+        "DimensionMappings",
+        "TimeValue",
+        "VersionValue"
+      ],
+      "additionalProperties": false
+    },
     "PlacementConstraint": {
       "type": "object",
       "properties": {
@@ -1494,6 +1649,30 @@
         "LATEST"
       ]
     },
+    "SingleMeasureMapping": {
+      "type": "object",
+      "properties": {
+        "MeasureValue": {
+          "type": "string",
+          "maxLength": 2048,
+          "minLength": 1
+        },
+        "MeasureValueType": {
+          "$ref": "#/definitions/MeasureValueType"
+        },
+        "MeasureName": {
+          "type": "string",
+          "maxLength": 1024,
+          "minLength": 1
+        }
+      },
+      "required": [
+        "MeasureName",
+        "MeasureValue",
+        "MeasureValueType"
+      ],
+      "additionalProperties": false
+    },
     "Tag": {
       "type": "object",
       "properties": {
@@ -1526,6 +1705,13 @@
         }
       },
       "additionalProperties": false
+    },
+    "TimeFieldType": {
+      "type": "string",
+      "enum": [
+        "EPOCH",
+        "TIMESTAMP_FORMAT"
+      ]
     }
   },
   "properties": {
diff --git a/internal/aws/cfn/schemas/aws/quicksight/refreshschedule.json b/internal/aws/cfn/schemas/aws/quicksight/refreshschedule.json
index f031c383..bffd1bc6 100644
--- a/internal/aws/cfn/schemas/aws/quicksight/refreshschedule.json
+++ b/internal/aws/cfn/schemas/aws/quicksight/refreshschedule.json
@@ -1,4 +1,5 @@
 {
+  "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-quicksight",
   "typeName": "AWS::QuickSight::RefreshSchedule",
   "description": "Definition of the AWS::QuickSight::RefreshSchedule Resource Type.",
   "definitions": {
@@ -147,7 +148,21 @@
     "list": {
       "permissions": [
         "quicksight:ListRefreshSchedules"
-      ]
+      ],
+      "handlerSchema": {
+        "properties": {
+          "AwsAccountId": {
+            "$ref": "resource-schema.json#/properties/AwsAccountId"
+          },
+          "DataSetId": {
+            "$ref": "resource-schema.json#/properties/DataSetId"
+          }
+        },
+        "required": [
+          "AwsAccountId",
+          "DataSetId"
+        ]
+      }
     },
     "read": {
       "permissions": [
diff --git a/internal/aws/cfn/schemas/aws/rds/dbcluster.json b/internal/aws/cfn/schemas/aws/rds/dbcluster.json
index b64bd2f5..751f1024 100644
--- a/internal/aws/cfn/schemas/aws/rds/dbcluster.json
+++ b/internal/aws/cfn/schemas/aws/rds/dbcluster.json
@@ -140,6 +140,10 @@
       "description": "The name of the database engine to be used for this DB cluster. Valid Values: aurora (for MySQL 5.6-compatible Aurora), aurora-mysql (for MySQL 5.7-compatible Aurora), and aurora-postgresql",
       "type": "string"
     },
+    "EngineLifecycleSupport": {
+      "description": "The life cycle type of the DB cluster. You can use this setting to enroll your DB cluster into Amazon RDS Extended Support.",
+      "type": "string"
+    },
     "EngineMode": {
       "description": "The DB engine mode of the DB cluster, either provisioned, serverless, parallelquery, global, or multimaster.",
       "type": "string"
diff --git a/internal/aws/cfn/schemas/aws/rds/dbinstance.json b/internal/aws/cfn/schemas/aws/rds/dbinstance.json
index 0700f23e..8e00b0f0 100644
--- a/internal/aws/cfn/schemas/aws/rds/dbinstance.json
+++ b/internal/aws/cfn/schemas/aws/rds/dbinstance.json
@@ -77,7 +77,7 @@
       "description": "The ``ProcessorFeature`` property type specifies the processor features of a DB instance class status."
     },
     "Tag": {
-      "description": "Metadata assigned to an Amazon RDS resource consisting of a key-value pair.\n For more information, see [Tagging Amazon RDS Resources](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Tagging.html) in the *Amazon RDS User Guide.*",
+      "description": "Metadata assigned to an Amazon RDS resource consisting of a key-value pair.\n For more information, see [Tagging Amazon RDS Resources](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Tagging.html) in the *Amazon RDS User Guide* or [Tagging Amazon Aurora and Amazon RDS Resources](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_Tagging.html) in the *Amazon Aurora User Guide*.",
       "type": "object",
       "additionalProperties": false,
       "properties": {
@@ -324,6 +324,10 @@
       "type": "string",
       "description": "The name of the database engine to use for this DB instance. Not every database engine is available in every AWS Region.\n This property is required when creating a DB instance.\n  You can convert an Oracle database from the non-CDB architecture to the container database (CDB) architecture by updating the ``Engine`` value in your templates from ``oracle-ee`` to ``oracle-ee-cdb`` or from ``oracle-se2`` to ``oracle-se2-cdb``. Converting to the CDB architecture requires an interruption.\n  Valid Values:\n  +   ``aurora-mysql`` (for Aurora MySQL DB instances)\n  +   ``aurora-postgresql`` (for Aurora PostgreSQL DB instances)\n  +   ``custom-oracle-ee`` (for RDS Custom for Oracle DB instances)\n  +   ``custom-oracle-ee-cdb`` (for RDS Custom for Oracle DB instances)\n  +   ``custom-sqlserver-ee`` (for RDS Custom for SQL Server DB instances)\n  +   ``custom-sqlserver-se`` (for RDS Custom for SQL Server DB instances)\n  +   ``custom-sqlserver-web`` (for RDS Custom for SQL Server DB instances)\n  +   ``db2-ae`` \n  +   ``db2-se`` \n  +   ``mariadb`` \n  +   ``mysql`` \n  +   ``oracle-ee`` \n  +   ``oracle-ee-cdb`` \n  +   ``oracle-se2`` \n  +   ``oracle-se2-cdb`` \n  +   ``postgres`` \n  +   ``sqlserver-ee`` \n  +   ``sqlserver-se`` \n  +   ``sqlserver-ex`` \n  +   ``sqlserver-web``"
     },
+    "EngineLifecycleSupport": {
+      "type": "string",
+      "description": ""
+    },
     "EngineVersion": {
       "type": "string",
       "description": "The version number of the database engine to use.\n For a list of valid engine versions, use the ``DescribeDBEngineVersions`` action.\n The following are the database engines and links to information about the major and minor versions that are available with Amazon RDS. Not every database engine is available for every AWS Region.\n  *Amazon Aurora* \n Not applicable. The version number of the database engine to be used by the DB instance is managed by the DB cluster.\n  *Db2* \n See [Amazon RDS for Db2](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_Db2.html#Db2.Concepts.VersionMgmt) in the *Amazon RDS User Guide.* \n  *MariaDB* \n See [MariaDB on Amazon RDS Versions](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_MariaDB.html#MariaDB.Concepts.VersionMgmt) in the *Amazon RDS User Guide.* \n  *Microsoft SQL Server* \n See [Microsoft SQL Server Versions on Amazon RDS](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_SQLServer.html#SQLServer.Concepts.General.VersionSupport) in the *Amazon RDS User Guide.* \n  *MySQL* \n See [MySQL on Amazon RDS Versions](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_MySQL.html#MySQL.Concepts.VersionMgmt) in the *Amazon RDS User Guide.* \n  *Oracle* \n See [Oracle Database Engine Release Notes](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.Oracle.PatchComposition.html) in the *Amazon RDS User Guide.* \n  *PostgreSQL* \n See [Supported PostgreSQL Database Versions](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_PostgreSQL.html#PostgreSQL.Concepts.General.DBVersions) in the *Amazon RDS User Guide.*"
@@ -338,7 +342,7 @@
     },
     "KmsKeyId": {
       "type": "string",
-      "description": "The ARN of the AWS KMS key that's used to encrypt the DB instance, such as ``arn:aws:kms:us-east-1:012345678910:key/abcd1234-a123-456a-a12b-a123b4cd56ef``. If you enable the StorageEncrypted property but don't specify this property, AWS CloudFormation uses the default KMS key. If you specify this property, you must set the StorageEncrypted property to true. \n If you specify the ``SourceDBInstanceIdentifier`` property, the value is inherited from the source DB instance if the read replica is created in the same region.\n If you create an encrypted read replica in a different AWS Region, then you must specify a KMS key for the destination AWS Region. KMS encryption keys are specific to the region that they're created in, and you can't use encryption keys from one region in another region.\n If you specify the ``DBSnapshotIdentifier`` property, don't specify this property. The ``StorageEncrypted`` property value is inherited from the snapshot. If the DB instance is encrypted, the specified ``KmsKeyId`` property is also inherited from the snapshot.\n If you specify ``DBSecurityGroups``, AWS CloudFormation ignores this property. To specify both a security group and this property, you must use a VPC security group. For more information about Amazon RDS and VPC, see [Using Amazon RDS with Amazon VPC](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_VPC.html) in the *Amazon RDS User Guide*.\n  *Amazon Aurora* \n Not applicable. The KMS key identifier is managed by the DB cluster.",
+      "description": "The ARN of the AWS KMS key that's used to encrypt the DB instance, such as ``arn:aws:kms:us-east-1:012345678910:key/abcd1234-a123-456a-a12b-a123b4cd56ef``. If you enable the StorageEncrypted property but don't specify this property, AWS CloudFormation uses the default KMS key. If you specify this property, you must set the StorageEncrypted property to true. \n If you specify the ``SourceDBInstanceIdentifier`` or ``SourceDbiResourceId`` property, don't specify this property. The value is inherited from the source DB instance, and if the DB instance is encrypted, the specified ``KmsKeyId`` property is used. However, if the source DB instance is in a different AWS Region, you must specify a KMS key ID.\n If you specify the ``SourceDBInstanceAutomatedBackupsArn`` property, don't specify this property. The value is inherited from the source DB instance automated backup, and if the automated backup is encrypted, the specified ``KmsKeyId`` property is used.\n If you create an encrypted read replica in a different AWS Region, then you must specify a KMS key for the destination AWS Region. KMS encryption keys are specific to the region that they're created in, and you can't use encryption keys from one region in another region.\n If you specify the ``DBSnapshotIdentifier`` property, don't specify this property. The ``StorageEncrypted`` property value is inherited from the snapshot. If the DB instance is encrypted, the specified ``KmsKeyId`` property is also inherited from the snapshot.\n If you specify ``DBSecurityGroups``, AWS CloudFormation ignores this property. To specify both a security group and this property, you must use a VPC security group. For more information about Amazon RDS and VPC, see [Using Amazon RDS with Amazon VPC](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_VPC.html) in the *Amazon RDS User Guide*.\n  *Amazon Aurora* \n Not applicable. The KMS key identifier is managed by the DB cluster.",
       "anyOf": [
         {
           "relationshipRef": {
@@ -481,7 +485,7 @@
     },
     "SourceDBInstanceIdentifier": {
       "type": "string",
-      "description": "If you want to create a read replica DB instance, specify the ID of the source DB instance. Each DB instance can have a limited number of read replicas. For more information, see [Working with Read Replicas](https://docs.aws.amazon.com/AmazonRDS/latest/DeveloperGuide/USER_ReadRepl.html) in the *Amazon RDS User Guide*.\n For information about constraints that apply to DB instance identifiers, see [Naming constraints in Amazon RDS](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_Limits.html#RDS_Limits.Constraints) in the *Amazon RDS User Guide*.\n The ``SourceDBInstanceIdentifier`` property determines whether a DB instance is a read replica. If you remove the ``SourceDBInstanceIdentifier`` property from your template and then update your stack, AWS CloudFormation promotes the Read Replica to a standalone DB instance.\n   +  If you specify a source DB instance that uses VPC security groups, we recommend that you specify the ``VPCSecurityGroups`` property. If you don't specify the property, the read replica inherits the value of the ``VPCSecurityGroups`` property from the source DB when you create the replica. However, if you update the stack, AWS CloudFormation reverts the replica's ``VPCSecurityGroups`` property to the default value because it's not defined in the stack's template. This change might cause unexpected issues.\n  +  Read replicas don't support deletion policies. AWS CloudFormation ignores any deletion policy that's associated with a read replica.\n  +  If you specify ``SourceDBInstanceIdentifier``, don't specify the ``DBSnapshotIdentifier`` property. You can't create a read replica from a snapshot.\n  +  Don't set the ``BackupRetentionPeriod``, ``DBName``, ``MasterUsername``, ``MasterUserPassword``, and ``PreferredBackupWindow`` properties. The database attributes are inherited from the source DB instance, and backups are disabled for read replicas.\n  +  If the source DB instance is in a different region than the read replica, specify the source region in ``SourceRegion``, and specify an ARN for a valid DB instance in ``SourceDBInstanceIdentifier``. For more information, see [Constructing a Amazon RDS Amazon Resource Name (ARN)](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Tagging.html#USER_Tagging.ARN) in the *Amazon RDS User Guide*.\n  +  For DB instances in Amazon Aurora clusters, don't specify this property. Amazon RDS automatically assigns writer and reader DB instances.",
+      "description": "If you want to create a read replica DB instance, specify the ID of the source DB instance. Each DB instance can have a limited number of read replicas. For more information, see [Working with Read Replicas](https://docs.aws.amazon.com/AmazonRDS/latest/DeveloperGuide/USER_ReadRepl.html) in the *Amazon RDS User Guide*.\n For information about constraints that apply to DB instance identifiers, see [Naming constraints in Amazon RDS](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_Limits.html#RDS_Limits.Constraints) in the *Amazon RDS User Guide*.\n The ``SourceDBInstanceIdentifier`` property determines whether a DB instance is a read replica. If you remove the ``SourceDBInstanceIdentifier`` property from your template and then update your stack, AWS CloudFormation promotes the read replica to a standalone DB instance.\n If you specify the ``UseLatestRestorableTime`` or ``RestoreTime`` properties in conjunction with the ``SourceDBInstanceIdentifier`` property, RDS restores the DB instance to the requested point in time, thereby creating a new DB instance.\n   +  If you specify a source DB instance that uses VPC security groups, we recommend that you specify the ``VPCSecurityGroups`` property. If you don't specify the property, the read replica inherits the value of the ``VPCSecurityGroups`` property from the source DB when you create the replica. However, if you update the stack, AWS CloudFormation reverts the replica's ``VPCSecurityGroups`` property to the default value because it's not defined in the stack's template. This change might cause unexpected issues.\n  +  Read replicas don't support deletion policies. AWS CloudFormation ignores any deletion policy that's associated with a read replica.\n  +  If you specify ``SourceDBInstanceIdentifier``, don't specify the ``DBSnapshotIdentifier`` property. You can't create a read replica from a snapshot.\n  +  Don't set the ``BackupRetentionPeriod``, ``DBName``, ``MasterUsername``, ``MasterUserPassword``, and ``PreferredBackupWindow`` properties. The database attributes are inherited from the source DB instance, and backups are disabled for read replicas.\n  +  If the source DB instance is in a different region than the read replica, specify the source region in ``SourceRegion``, and specify an ARN for a valid DB instance in ``SourceDBInstanceIdentifier``. For more information, see [Constructing a Amazon RDS Amazon Resource Name (ARN)](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Tagging.html#USER_Tagging.ARN) in the *Amazon RDS User Guide*.\n  +  For DB instances in Amazon Aurora clusters, don't specify this property. Amazon RDS automatically assigns writer and reader DB instances.",
       "relationshipRef": {
         "typeName": "AWS::RDS::DBInstance",
         "propertyPath": "/properties/DBInstanceIdentifier"
@@ -493,7 +497,7 @@
     },
     "StorageEncrypted": {
       "type": "boolean",
-      "description": "A value that indicates whether the DB instance is encrypted. By default, it isn't encrypted.\n If you specify the ``KmsKeyId`` property, then you must enable encryption.\n If you specify the ``SourceDBInstanceIdentifier`` property, don't specify this property. The value is inherited from the source DB instance, and if the DB instance is encrypted, the specified ``KmsKeyId`` property is used.\n If you specify ``DBSnapshotIdentifier`` property, don't specify this property. The value is inherited from the snapshot.\n  *Amazon Aurora* \n Not applicable. The encryption for DB instances is managed by the DB cluster."
+      "description": "A value that indicates whether the DB instance is encrypted. By default, it isn't encrypted.\n If you specify the ``KmsKeyId`` property, then you must enable encryption.\n If you specify the ``SourceDBInstanceIdentifier`` or ``SourceDbiResourceId`` property, don't specify this property. The value is inherited from the source DB instance, and if the DB instance is encrypted, the specified ``KmsKeyId`` property is used.\n If you specify the ``SourceDBInstanceAutomatedBackupsArn`` property, don't specify this property. The value is inherited from the source DB instance automated backup. \n If you specify ``DBSnapshotIdentifier`` property, don't specify this property. The value is inherited from the snapshot.\n  *Amazon Aurora* \n Not applicable. The encryption for DB instances is managed by the DB cluster."
     },
     "StorageType": {
       "type": "string",
diff --git a/internal/aws/cfn/schemas/aws/rds/dbparametergroup.json b/internal/aws/cfn/schemas/aws/rds/dbparametergroup.json
index 48518263..ab7c4f72 100644
--- a/internal/aws/cfn/schemas/aws/rds/dbparametergroup.json
+++ b/internal/aws/cfn/schemas/aws/rds/dbparametergroup.json
@@ -5,7 +5,7 @@
   "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-rds",
   "definitions": {
     "Tag": {
-      "description": "Metadata assigned to an Amazon RDS resource consisting of a key-value pair.\n For more information, see [Tagging Amazon RDS Resources](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Tagging.html) in the *Amazon RDS User Guide.*",
+      "description": "Metadata assigned to an Amazon RDS resource consisting of a key-value pair.\n For more information, see [Tagging Amazon RDS Resources](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Tagging.html) in the *Amazon RDS User Guide* or [Tagging Amazon Aurora and Amazon RDS Resources](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_Tagging.html) in the *Amazon Aurora User Guide*.",
       "type": "object",
       "properties": {
         "Key": {
diff --git a/internal/aws/cfn/schemas/aws/rds/dbsubnetgroup.json b/internal/aws/cfn/schemas/aws/rds/dbsubnetgroup.json
index 615223ea..02e94161 100644
--- a/internal/aws/cfn/schemas/aws/rds/dbsubnetgroup.json
+++ b/internal/aws/cfn/schemas/aws/rds/dbsubnetgroup.json
@@ -9,7 +9,6 @@
     },
     "DBSubnetGroupName": {
       "type": "string",
-      "pattern": "^(?!default$)[a-zA-Z]{1}[a-zA-Z0-9-_\\.\\s]{0,254}$",
       "description": "The name for the DB subnet group. This value is stored as a lowercase string.\n Constraints: Must contain no more than 255 lowercase alphanumeric characters or hyphens. Must not be \"Default\".\n Example: ``mysubnetgroup``"
     },
     "SubnetIds": {
@@ -33,7 +32,7 @@
   },
   "definitions": {
     "Tag": {
-      "description": "Metadata assigned to an Amazon RDS resource consisting of a key-value pair.\n For more information, see [Tagging Amazon RDS Resources](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Tagging.html) in the *Amazon RDS User Guide.*",
+      "description": "Metadata assigned to an Amazon RDS resource consisting of a key-value pair.\n For more information, see [Tagging Amazon RDS Resources](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Tagging.html) in the *Amazon RDS User Guide* or [Tagging Amazon Aurora and Amazon RDS Resources](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_Tagging.html) in the *Amazon Aurora User Guide*.",
       "type": "object",
       "additionalProperties": false,
       "properties": {
diff --git a/internal/aws/cfn/schemas/aws/rolesanywhere/profile.json b/internal/aws/cfn/schemas/aws/rolesanywhere/profile.json
index af2207b3..b65fa6cb 100644
--- a/internal/aws/cfn/schemas/aws/rolesanywhere/profile.json
+++ b/internal/aws/cfn/schemas/aws/rolesanywhere/profile.json
@@ -2,6 +2,45 @@
   "typeName": "AWS::RolesAnywhere::Profile",
   "description": "Definition of AWS::RolesAnywhere::Profile Resource Type",
   "definitions": {
+    "AttributeMapping": {
+      "type": "object",
+      "properties": {
+        "MappingRules": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/MappingRule"
+          }
+        },
+        "CertificateField": {
+          "$ref": "#/definitions/CertificateField"
+        }
+      },
+      "required": [
+        "CertificateField",
+        "MappingRules"
+      ],
+      "additionalProperties": false
+    },
+    "MappingRule": {
+      "type": "object",
+      "properties": {
+        "Specifier": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "Specifier"
+      ],
+      "additionalProperties": false
+    },
+    "CertificateField": {
+      "type": "string",
+      "enum": [
+        "x509Subject",
+        "x509Issuer",
+        "x509SAN"
+      ]
+    },
     "Tag": {
       "type": "object",
       "properties": {
@@ -69,6 +108,12 @@
       },
       "maxItems": 200,
       "minItems": 0
+    },
+    "AttributeMappings": {
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/AttributeMapping"
+      }
     }
   },
   "readOnlyProperties": [
@@ -90,7 +135,9 @@
         "iam:PassRole",
         "rolesanywhere:CreateProfile",
         "rolesanywhere:TagResource",
-        "rolesanywhere:ListTagsForResource"
+        "rolesanywhere:ListTagsForResource",
+        "rolesanywhere:PutAttributeMapping",
+        "rolesanywhere:DeleteAttributeMapping"
       ]
     },
     "read": {
@@ -104,12 +151,15 @@
         "iam:GetRole",
         "iam:GetPolicy",
         "iam:PassRole",
+        "rolesanywhere:GetProfile",
         "rolesanywhere:UpdateProfile",
         "rolesanywhere:EnableProfile",
         "rolesanywhere:DisableProfile",
         "rolesanywhere:TagResource",
         "rolesanywhere:UntagResource",
-        "rolesanywhere:ListTagsForResource"
+        "rolesanywhere:ListTagsForResource",
+        "rolesanywhere:PutAttributeMapping",
+        "rolesanywhere:DeleteAttributeMapping"
       ]
     },
     "delete": {
diff --git a/internal/aws/cfn/schemas/aws/route53/hostedzone.json b/internal/aws/cfn/schemas/aws/route53/hostedzone.json
index 0ddc4692..ad4dc05f 100644
--- a/internal/aws/cfn/schemas/aws/route53/hostedzone.json
+++ b/internal/aws/cfn/schemas/aws/route53/hostedzone.json
@@ -135,7 +135,7 @@
     "/properties/Id"
   ],
   "propertyTransform": {
-    "/properties/Name": "$join([Name, \".\"])"
+    "/properties/Name": "Name $OR $join([Name, \".\"])"
   },
   "handlers": {
     "create": {
diff --git a/internal/aws/cfn/schemas/aws/sagemaker/domain.json b/internal/aws/cfn/schemas/aws/sagemaker/domain.json
index c2130ddc..499d04f2 100644
--- a/internal/aws/cfn/schemas/aws/sagemaker/domain.json
+++ b/internal/aws/cfn/schemas/aws/sagemaker/domain.json
@@ -375,7 +375,7 @@
           "uniqueItems": false,
           "insertionOrder": false,
           "minItems": 0,
-          "maxItems": 30,
+          "maxItems": 200,
           "items": {
             "$ref": "#/definitions/CustomImage"
           }
@@ -420,7 +420,7 @@
           "description": "A list of custom images for use for JupyterLab apps.",
           "uniqueItems": false,
           "minItems": 0,
-          "maxItems": 30,
+          "maxItems": 200,
           "items": {
             "$ref": "#/definitions/CustomImage"
           }
@@ -500,7 +500,7 @@
           "description": "A list of custom images for use for CodeEditor apps.",
           "uniqueItems": false,
           "minItems": 0,
-          "maxItems": 30,
+          "maxItems": 200,
           "items": {
             "$ref": "#/definitions/CustomImage"
           }
@@ -686,8 +686,9 @@
           "maxItems": 10,
           "items": {
             "type": "string",
+            "minLength": 12,
             "maxLength": 12,
-            "pattern": "^[0-9]$"
+            "pattern": "^\\d+$"
           }
         }
       }
@@ -733,7 +734,7 @@
           "insertionOrder": false,
           "uniqueItems": false,
           "minItems": 0,
-          "maxItems": 30,
+          "maxItems": 200,
           "items": {
             "$ref": "#/definitions/CustomImage"
           }
diff --git a/internal/aws/cfn/schemas/aws/ses/configurationseteventdestination.json b/internal/aws/cfn/schemas/aws/ses/configurationseteventdestination.json
index c27ec0a9..78c9d1e9 100644
--- a/internal/aws/cfn/schemas/aws/ses/configurationseteventdestination.json
+++ b/internal/aws/cfn/schemas/aws/ses/configurationseteventdestination.json
@@ -36,12 +36,32 @@
         "SnsDestination": {
           "description": "An object that contains SNS topic ARN associated event destination.",
           "$ref": "#/definitions/SnsDestination"
+        },
+        "EventBridgeDestination": {
+          "description": "An object that contains Event bus ARN associated with the event bridge destination.",
+          "$ref": "#/definitions/EventBridgeDestination"
         }
       },
       "required": [
         "MatchingEventTypes"
       ]
     },
+    "EventBridgeDestination": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "An object that contains Event bus ARN associated with the event bridge destination.",
+      "properties": {
+        "EventBusArn": {
+          "type": "string",
+          "minLength": 36,
+          "maxLength": 1024,
+          "pattern": "^arn:aws[a-z0-9-]*:events:[a-z0-9-]+:\\d{12}:event-bus/[^:]+$"
+        }
+      },
+      "required": [
+        "EventBusArn"
+      ]
+    },
     "SnsDestination": {
       "type": "object",
       "additionalProperties": false,
diff --git a/internal/aws/cfn/schemas/aws/signer/profilepermission.json b/internal/aws/cfn/schemas/aws/signer/profilepermission.json
index 70e0c9a7..ac47cd67 100644
--- a/internal/aws/cfn/schemas/aws/signer/profilepermission.json
+++ b/internal/aws/cfn/schemas/aws/signer/profilepermission.json
@@ -4,7 +4,8 @@
   "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-rpdk.git",
   "properties": {
     "ProfileName": {
-      "type": "string"
+      "type": "string",
+      "pattern": "^[0-9a-zA-Z_]{2,64}$"
     },
     "ProfileVersion": {
       "type": "string",
diff --git a/internal/aws/cfn/schemas/aws/signer/signingprofile.json b/internal/aws/cfn/schemas/aws/signer/signingprofile.json
index b713bf2e..ea6d2c89 100644
--- a/internal/aws/cfn/schemas/aws/signer/signingprofile.json
+++ b/internal/aws/cfn/schemas/aws/signer/signingprofile.json
@@ -14,6 +14,12 @@
       "type": "string",
       "pattern": "^arn:aws(-(cn|us-gov))?:[a-z-]+:(([a-z]+-)+[0-9])?:([0-9]{12})?:[^.]+$"
     },
+    "ProfileName": {
+      "type": "string",
+      "minLength": 2,
+      "maxLength": 64,
+      "pattern": "^[0-9a-zA-Z_]$"
+    },
     "ProfileVersion": {
       "type": "string",
       "pattern": "^[0-9a-zA-Z]{10}$"
@@ -55,8 +61,8 @@
   },
   "properties": {
     "ProfileName": {
-      "description": "A name for the signing profile. AWS CloudFormation generates a unique physical ID and uses that ID for the signing profile name. ",
-      "type": "string"
+      "description": "A name for the signing profile. If you don't specify a name, AWS CloudFormation generates a unique physical ID and uses that ID for the signing profile name. ",
+      "$ref": "#/definitions/ProfileName"
     },
     "ProfileVersion": {
       "description": "A version for the signing profile. AWS Signer generates a unique version for each profile of the same profile name.",
@@ -91,6 +97,7 @@
     "PlatformId"
   ],
   "createOnlyProperties": [
+    "/properties/ProfileName",
     "/properties/PlatformId",
     "/properties/SignatureValidityPeriod"
   ],
diff --git a/internal/aws/cfn/schemas/aws/stepfunctions/statemachine.json b/internal/aws/cfn/schemas/aws/stepfunctions/statemachine.json
index a1095706..5fc41209 100644
--- a/internal/aws/cfn/schemas/aws/stepfunctions/statemachine.json
+++ b/internal/aws/cfn/schemas/aws/stepfunctions/statemachine.json
@@ -1,94 +1,179 @@
 {
+  "tagging": {
+    "taggable": true,
+    "tagOnCreate": true,
+    "tagUpdatable": true,
+    "tagProperty": "/properties/Tags",
+    "cloudFormationSystemTags": true
+  },
   "typeName": "AWS::StepFunctions::StateMachine",
+  "readOnlyProperties": [
+    "/properties/Arn",
+    "/properties/Name",
+    "/properties/StateMachineRevisionId"
+  ],
   "description": "Resource schema for StateMachine",
+  "createOnlyProperties": [
+    "/properties/StateMachineName",
+    "/properties/StateMachineType"
+  ],
+  "primaryIdentifier": [
+    "/properties/Arn"
+  ],
+  "required": [
+    "RoleArn"
+  ],
   "sourceUrl": "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-stepfunctions.git",
+  "handlers": {
+    "read": {
+      "permissions": [
+        "states:DescribeStateMachine",
+        "states:ListTagsForResource"
+      ]
+    },
+    "create": {
+      "permissions": [
+        "states:CreateStateMachine",
+        "states:DescribeStateMachine",
+        "states:TagResource",
+        "iam:PassRole",
+        "s3:GetObject"
+      ]
+    },
+    "update": {
+      "permissions": [
+        "states:UpdateStateMachine",
+        "states:TagResource",
+        "states:UntagResource",
+        "states:ListTagsForResource",
+        "iam:PassRole"
+      ]
+    },
+    "list": {
+      "permissions": [
+        "states:ListStateMachines"
+      ]
+    },
+    "delete": {
+      "permissions": [
+        "states:DeleteStateMachine",
+        "states:DescribeStateMachine"
+      ]
+    }
+  },
+  "writeOnlyProperties": [
+    "/properties/Definition",
+    "/properties/DefinitionS3Location",
+    "/properties/DefinitionSubstitutions"
+  ],
+  "additionalIdentifiers": [
+    [
+      "/properties/StateMachineName"
+    ]
+  ],
+  "additionalProperties": false,
   "definitions": {
-    "TagsEntry": {
+    "LoggingConfiguration": {
+      "additionalProperties": false,
       "type": "object",
       "properties": {
-        "Key": {
-          "type": "string",
-          "minLength": 1,
-          "maxLength": 128
+        "IncludeExecutionData": {
+          "type": "boolean"
         },
-        "Value": {
+        "Destinations": {
+          "minItems": 1,
+          "insertionOrder": false,
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/LogDestination"
+          }
+        },
+        "Level": {
           "type": "string",
-          "minLength": 1,
-          "maxLength": 256
+          "enum": [
+            "ALL",
+            "ERROR",
+            "FATAL",
+            "OFF"
+          ]
+        }
+      }
+    },
+    "DefinitionSubstitutions": {
+      "patternProperties": {
+        ".*": {
+          "anyOf": [
+            {
+              "type": "string"
+            },
+            {
+              "type": "integer"
+            },
+            {
+              "type": "boolean"
+            }
+          ]
         }
       },
       "additionalProperties": false,
-      "required": [
-        "Key",
-        "Value"
-      ]
+      "type": "object",
+      "minProperties": 1
     },
-    "CloudWatchLogsLogGroup": {
+    "Definition": {
       "type": "object",
-      "additionalProperties": false,
-      "properties": {
-        "LogGroupArn": {
-          "type": "string",
-          "minLength": 1,
-          "maxLength": 256
-        }
-      }
+      "minProperties": 1
     },
     "LogDestination": {
-      "type": "object",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
         "CloudWatchLogsLogGroup": {
           "$ref": "#/definitions/CloudWatchLogsLogGroup"
         }
       }
     },
-    "LoggingConfiguration": {
-      "type": "object",
+    "TagsEntry": {
       "additionalProperties": false,
+      "type": "object",
       "properties": {
-        "Level": {
+        "Value": {
+          "minLength": 1,
           "type": "string",
-          "enum": [
-            "ALL",
-            "ERROR",
-            "FATAL",
-            "OFF"
-          ]
-        },
-        "IncludeExecutionData": {
-          "type": "boolean"
+          "maxLength": 256
         },
-        "Destinations": {
-          "type": "array",
-          "minItems": 1,
-          "insertionOrder": false,
-          "items": {
-            "$ref": "#/definitions/LogDestination"
-          }
+        "Key": {
+          "minLength": 1,
+          "type": "string",
+          "maxLength": 128
         }
-      }
+      },
+      "required": [
+        "Key",
+        "Value"
+      ]
     },
-    "TracingConfiguration": {
-      "type": "object",
+    "CloudWatchLogsLogGroup": {
       "additionalProperties": false,
+      "type": "object",
       "properties": {
-        "Enabled": {
-          "type": "boolean"
+        "LogGroupArn": {
+          "minLength": 1,
+          "type": "string",
+          "maxLength": 256
         }
       }
     },
     "S3Location": {
-      "type": "object",
       "additionalProperties": false,
+      "type": "object",
       "properties": {
         "Bucket": {
           "type": "string"
         },
-        "Key": {
+        "Version": {
           "type": "string"
         },
-        "Version": {
+        "Key": {
           "type": "string"
         }
       },
@@ -97,55 +182,31 @@
         "Key"
       ]
     },
-    "DefinitionSubstitutions": {
-      "type": "object",
+    "TracingConfiguration": {
       "additionalProperties": false,
-      "patternProperties": {
-        ".*": {
-          "anyOf": [
-            {
-              "type": "string"
-            },
-            {
-              "type": "integer"
-            },
-            {
-              "type": "boolean"
-            }
-          ]
-        }
-      },
-      "minProperties": 1
-    },
-    "Definition": {
       "type": "object",
-      "minProperties": 1
+      "properties": {
+        "Enabled": {
+          "type": "boolean"
+        }
+      }
     }
   },
   "properties": {
-    "Arn": {
-      "type": "string",
-      "minLength": 1,
-      "maxLength": 2048
-    },
-    "Name": {
-      "type": "string",
-      "minLength": 1,
-      "maxLength": 80
+    "DefinitionSubstitutions": {
+      "$ref": "#/definitions/DefinitionSubstitutions"
     },
-    "DefinitionString": {
-      "type": "string",
-      "minLength": 1,
-      "maxLength": 1048576
+    "Definition": {
+      "$ref": "#/definitions/Definition"
     },
     "RoleArn": {
-      "type": "string",
       "minLength": 1,
+      "type": "string",
       "maxLength": 256
     },
-    "StateMachineName": {
-      "type": "string",
+    "Name": {
       "minLength": 1,
+      "type": "string",
       "maxLength": 80
     },
     "StateMachineType": {
@@ -155,103 +216,42 @@
         "EXPRESS"
       ]
     },
-    "StateMachineRevisionId": {
-      "type": "string",
+    "TracingConfiguration": {
+      "$ref": "#/definitions/TracingConfiguration"
+    },
+    "DefinitionString": {
       "minLength": 1,
-      "maxLength": 256
+      "type": "string",
+      "maxLength": 1048576
     },
     "LoggingConfiguration": {
       "$ref": "#/definitions/LoggingConfiguration"
     },
-    "TracingConfiguration": {
-      "$ref": "#/definitions/TracingConfiguration"
+    "StateMachineRevisionId": {
+      "minLength": 1,
+      "type": "string",
+      "maxLength": 256
     },
     "DefinitionS3Location": {
       "$ref": "#/definitions/S3Location"
     },
-    "DefinitionSubstitutions": {
-      "$ref": "#/definitions/DefinitionSubstitutions"
+    "Arn": {
+      "minLength": 1,
+      "type": "string",
+      "maxLength": 2048
     },
-    "Definition": {
-      "$ref": "#/definitions/Definition"
+    "StateMachineName": {
+      "minLength": 1,
+      "type": "string",
+      "maxLength": 80
     },
     "Tags": {
-      "type": "array",
       "uniqueItems": false,
       "insertionOrder": false,
+      "type": "array",
       "items": {
         "$ref": "#/definitions/TagsEntry"
       }
     }
-  },
-  "required": [
-    "RoleArn"
-  ],
-  "tagging": {
-    "taggable": true,
-    "tagOnCreate": true,
-    "tagUpdatable": true,
-    "cloudFormationSystemTags": true,
-    "tagProperty": "/properties/Tags"
-  },
-  "additionalProperties": false,
-  "readOnlyProperties": [
-    "/properties/Arn",
-    "/properties/Name",
-    "/properties/StateMachineRevisionId"
-  ],
-  "createOnlyProperties": [
-    "/properties/StateMachineName",
-    "/properties/StateMachineType"
-  ],
-  "writeOnlyProperties": [
-    "/properties/Definition",
-    "/properties/DefinitionS3Location",
-    "/properties/DefinitionSubstitutions"
-  ],
-  "primaryIdentifier": [
-    "/properties/Arn"
-  ],
-  "additionalIdentifiers": [
-    [
-      "/properties/StateMachineName"
-    ]
-  ],
-  "handlers": {
-    "create": {
-      "permissions": [
-        "states:CreateStateMachine",
-        "states:DescribeStateMachine",
-        "states:TagResource",
-        "iam:PassRole",
-        "s3:GetObject"
-      ]
-    },
-    "read": {
-      "permissions": [
-        "states:DescribeStateMachine",
-        "states:ListTagsForResource"
-      ]
-    },
-    "update": {
-      "permissions": [
-        "states:UpdateStateMachine",
-        "states:TagResource",
-        "states:UntagResource",
-        "states:ListTagsForResource",
-        "iam:PassRole"
-      ]
-    },
-    "delete": {
-      "permissions": [
-        "states:DeleteStateMachine",
-        "states:DescribeStateMachine"
-      ]
-    },
-    "list": {
-      "permissions": [
-        "states:ListStateMachines"
-      ]
-    }
   }
 }
diff --git a/internal/aws/cfn/schemas/aws/synthetics/canary.json b/internal/aws/cfn/schemas/aws/synthetics/canary.json
index 7601a1da..fc2d6100 100644
--- a/internal/aws/cfn/schemas/aws/synthetics/canary.json
+++ b/internal/aws/cfn/schemas/aws/synthetics/canary.json
@@ -35,7 +35,11 @@
     },
     "ExecutionRoleArn": {
       "description": "Lambda Execution role used to run your canaries",
-      "type": "string"
+      "type": "string",
+      "relationshipRef": {
+        "typeName": "AWS::IAM::Role",
+        "propertyPath": "/properties/Arn"
+      }
     },
     "RuntimeVersion": {
       "description": "Runtime version of Synthetics Library",
@@ -98,7 +102,11 @@
       "additionalProperties": false,
       "properties": {
         "S3Bucket": {
-          "type": "string"
+          "type": "string",
+          "relationshipRef": {
+            "typeName": "AWS::S3::Bucket",
+            "propertyPath": "/properties/BucketName"
+          }
         },
         "S3Key": {
           "type": "string"
@@ -161,18 +169,40 @@
       "additionalProperties": false,
       "properties": {
         "VpcId": {
-          "type": "string"
+          "type": "string",
+          "relationshipRef": {
+            "typeName": "AWS::EC2::VPC",
+            "propertyPath": "/properties/VpcId"
+          }
         },
         "SubnetIds": {
           "type": "array",
           "items": {
-            "type": "string"
+            "type": "string",
+            "relationshipRef": {
+              "typeName": "AWS::EC2::Subnet",
+              "propertyPath": "/properties/SubnetId"
+            }
           }
         },
         "SecurityGroupIds": {
           "type": "array",
           "items": {
-            "type": "string"
+            "type": "string",
+            "anyOf": [
+              {
+                "relationshipRef": {
+                  "typeName": "AWS::EC2::SecurityGroup",
+                  "propertyPath": "/properties/GroupId"
+                }
+              },
+              {
+                "relationshipRef": {
+                  "typeName": "AWS::EC2::VPC",
+                  "propertyPath": "/properties/DefaultSecurityGroup"
+                }
+              }
+            ]
           }
         }
       },
diff --git a/internal/aws/cfn/schemas/aws/transfer/connector.json b/internal/aws/cfn/schemas/aws/transfer/connector.json
index 2e4c98c5..290fa121 100644
--- a/internal/aws/cfn/schemas/aws/transfer/connector.json
+++ b/internal/aws/cfn/schemas/aws/transfer/connector.json
@@ -171,6 +171,7 @@
     "ServiceManagedEgressIpAddresses": {
       "description": "The list of egress IP addresses of this connector. These IP addresses are assigned automatically when you create the connector.",
       "type": "array",
+      "insertionOrder": false,
       "items": {
         "type": "string",
         "pattern": "^\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}$"
diff --git a/internal/config/version.go b/internal/config/version.go
index 6b1af16a..700cbe20 100644
--- a/internal/config/version.go
+++ b/internal/config/version.go
@@ -5,5 +5,5 @@ const (
 	NAME = "Rain"
 
 	// VERSION is the application's version string
-	VERSION = "v1.10.0"
+	VERSION = "v1.11.0"
 )