feat(sources): update documentation

[aws-cdk-automation]

⚠️ This Pull Request updates daily and will overwrite all manual changes pushed to the branch

Updates the documentation source from upstream. See details in workflow run.

---

Automatically created by projen via the "update-source-documentation" workflow

[github-actions]

To work on this Pull Request, please create a new branch and PR. This prevents your work from being deleted by the automation.

Run the following commands inside the repo:

gh co 842
git switch -c fix-pr-842 && git push -u origin HEAD
gh pr create -t "fix: PR #842" --body "Fixes https://github.com/cdklabs/awscdk-service-spec/pull/842"

[github-actions]

@aws-cdk/aws-service-spec: Model database diff detected

├[~] service aws-batch
│ └ resources
│    └[~] resource AWS::Batch::JobDefinition
│      ├  - documentation: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-batch-jobdefinition.html
│      │  + documentation: The `AWS::Batch::JobDefinition` resource specifies the parameters for an AWS Batch job definition. For more information, see [Job Definitions](https://docs.aws.amazon.com/batch/latest/userguide/job_definitions.html) in the ** .
│      ├ properties
│      │  ├ ContainerProperties: (documentation changed)
│      │  ├ EksProperties: (documentation changed)
│      │  ├ JobDefinitionName: (documentation changed)
│      │  ├ NodeProperties: (documentation changed)
│      │  ├ Parameters: (documentation changed)
│      │  ├ PlatformCapabilities: (documentation changed)
│      │  ├ PropagateTags: (documentation changed)
│      │  ├ RetryStrategy: (documentation changed)
│      │  ├ SchedulingPriority: (documentation changed)
│      │  ├ Tags: (documentation changed)
│      │  ├ Timeout: (documentation changed)
│      │  └ Type: (documentation changed)
│      └ types
│         ├[~] type AuthorizationConfig
│         │ ├  - documentation: undefined
│         │ │  + documentation: The authorization configuration details for the Amazon EFS file system.
│         │ └ properties
│         │    ├ AccessPointId: (documentation changed)
│         │    └ Iam: (documentation changed)
│         ├[~] type ContainerProperties
│         │ ├  - documentation: undefined
│         │ │  + documentation: Container properties are used for Amazon ECS based job definitions. These properties to describe the container that's launched as part of a job.
│         │ └ properties
│         │    ├ Command: (documentation changed)
│         │    ├ Environment: (documentation changed)
│         │    ├ EphemeralStorage: (documentation changed)
│         │    ├ ExecutionRoleArn: (documentation changed)
│         │    ├ FargatePlatformConfiguration: (documentation changed)
│         │    ├ Image: (documentation changed)
│         │    ├ InstanceType: (documentation changed)
│         │    ├ JobRoleArn: (documentation changed)
│         │    ├ LinuxParameters: (documentation changed)
│         │    ├ LogConfiguration: (documentation changed)
│         │    ├ Memory: (documentation changed)
│         │    ├ MountPoints: (documentation changed)
│         │    ├ NetworkConfiguration: (documentation changed)
│         │    ├ Privileged: (documentation changed)
│         │    ├ ReadonlyRootFilesystem: (documentation changed)
│         │    ├ ResourceRequirements: (documentation changed)
│         │    ├ RuntimePlatform: (documentation changed)
│         │    ├ Secrets: (documentation changed)
│         │    ├ Ulimits: (documentation changed)
│         │    ├ User: (documentation changed)
│         │    ├ Vcpus: (documentation changed)
│         │    └ Volumes: (documentation changed)
│         ├[~] type Device
│         │ ├  - documentation: undefined
│         │ │  + documentation: An object that represents a container instance host device.
│         │ │  > This object isn't applicable to jobs that are running on Fargate resources and shouldn't be provided.
│         │ └ properties
│         │    ├ ContainerPath: (documentation changed)
│         │    ├ HostPath: (documentation changed)
│         │    └ Permissions: (documentation changed)
│         ├[~] type EfsVolumeConfiguration
│         │ ├  - documentation: undefined
│         │ │  + documentation: This is used when you're using an Amazon Elastic File System file system for job storage. For more information, see [Amazon EFS Volumes](https://docs.aws.amazon.com/batch/latest/userguide/efs-volumes.html) in the *AWS Batch User Guide* .
│         │ └ properties
│         │    ├ AuthorizationConfig: (documentation changed)
│         │    ├ FileSystemId: (documentation changed)
│         │    ├ RootDirectory: (documentation changed)
│         │    ├ TransitEncryption: (documentation changed)
│         │    └ TransitEncryptionPort: (documentation changed)
│         ├[~] type EksContainer
│         │ ├  - documentation: undefined
│         │ │  + documentation: EKS container properties are used in job definitions for Amazon EKS based job definitions to describe the properties for a container node in the pod that's launched as part of a job. This can't be specified for Amazon ECS based job definitions.
│         │ └ properties
│         │    ├ Args: (documentation changed)
│         │    ├ Command: (documentation changed)
│         │    ├ Env: (documentation changed)
│         │    ├ Image: (documentation changed)
│         │    ├ ImagePullPolicy: (documentation changed)
│         │    ├ Name: (documentation changed)
│         │    ├ Resources: (documentation changed)
│         │    ├ SecurityContext: (documentation changed)
│         │    └ VolumeMounts: (documentation changed)
│         ├[~] type EksContainerEnvironmentVariable
│         │ ├  - documentation: undefined
│         │ │  + documentation: An environment variable.
│         │ └ properties
│         │    ├ Name: (documentation changed)
│         │    └ Value: (documentation changed)
│         ├[~] type EksContainerVolumeMount
│         │ ├  - documentation: undefined
│         │ │  + documentation: The volume mounts for a container for an Amazon EKS job. For more information about volumes and volume mounts in Kubernetes, see [Volumes](https://docs.aws.amazon.com/https://kubernetes.io/docs/concepts/storage/volumes/) in the *Kubernetes documentation* .
│         │ └ properties
│         │    ├ MountPath: (documentation changed)
│         │    ├ Name: (documentation changed)
│         │    └ ReadOnly: (documentation changed)
│         ├[~] type EksProperties
│         │ ├  - documentation: undefined
│         │ │  + documentation: An object that contains the properties for the Kubernetes resources of a job.
│         │ └ properties
│         │    └ PodProperties: (documentation changed)
│         ├[~] type EksSecret
│         │ ├  - documentation: undefined
│         │ │  + documentation: Specifies the configuration of a Kubernetes `secret` volume. For more information, see [secret](https://docs.aws.amazon.com/https://kubernetes.io/docs/concepts/storage/volumes/#secret) in the *Kubernetes documentation* .
│         │ └ properties
│         │    ├ Optional: (documentation changed)
│         │    └ SecretName: (documentation changed)
│         ├[~] type EksVolume
│         │ ├  - documentation: undefined
│         │ │  + documentation: Specifies an Amazon EKS volume for a job definition.
│         │ └ properties
│         │    ├ EmptyDir: (documentation changed)
│         │    ├ HostPath: (documentation changed)
│         │    ├ Name: (documentation changed)
│         │    └ Secret: (documentation changed)
│         ├[~] type Environment
│         │ ├  - documentation: undefined
│         │ │  + documentation: The Environment property type specifies environment variables to use in a job definition.
│         │ └ properties
│         │    ├ Name: (documentation changed)
│         │    └ Value: (documentation changed)
│         ├[~] type EphemeralStorage
│         │ ├  - documentation: undefined
│         │ │  + documentation: The amount of ephemeral storage to allocate for the task. This parameter is used to expand the total amount of ephemeral storage available, beyond the default amount, for tasks hosted on AWS Fargate .
│         │ └ properties
│         │    └ SizeInGiB: (documentation changed)
│         ├[~] type EvaluateOnExit
│         │ ├  - documentation: undefined
│         │ │  + documentation: Specifies an array of up to 5 conditions to be met, and an action to take ( `RETRY` or `EXIT` ) if all conditions are met. If none of the `EvaluateOnExit` conditions in a `RetryStrategy` match, then the job is retried.
│         │ └ properties
│         │    ├ Action: (documentation changed)
│         │    ├ OnExitCode: (documentation changed)
│         │    ├ OnReason: (documentation changed)
│         │    └ OnStatusReason: (documentation changed)
│         ├[~] type FargatePlatformConfiguration
│         │ ├  - documentation: undefined
│         │ │  + documentation: The platform configuration for jobs that are running on Fargate resources. Jobs that run on EC2 resources must not specify this parameter.
│         │ └ properties
│         │    └ PlatformVersion: (documentation changed)
│         ├[~] type LinuxParameters
│         │ ├  - documentation: undefined
│         │ │  + documentation: Linux-specific modifications that are applied to the container, such as details for device mappings.
│         │ └ properties
│         │    ├ Devices: (documentation changed)
│         │    ├ InitProcessEnabled: (documentation changed)
│         │    ├ MaxSwap: (documentation changed)
│         │    ├ SharedMemorySize: (documentation changed)
│         │    ├ Swappiness: (documentation changed)
│         │    └ Tmpfs: (documentation changed)
│         ├[~] type LogConfiguration
│         │ ├  - documentation: undefined
│         │ │  + documentation: Log configuration options to send to a custom log driver for the container.
│         │ └ properties
│         │    ├ LogDriver: (documentation changed)
│         │    ├ Options: (documentation changed)
│         │    └ SecretOptions: (documentation changed)
│         ├[~] type MountPoints
│         │ ├  - documentation: undefined
│         │ │  + documentation: Details for a Docker volume mount point that's used in a job's container properties. This parameter maps to `Volumes` in the [Create a container](https://docs.aws.amazon.com/https://docs.docker.com/engine/api/v1.43/#tag/Container/operation/ContainerCreate) section of the *Docker Remote API* and the `--volume` option to docker run.
│         │ └ properties
│         │    ├ ContainerPath: (documentation changed)
│         │    ├ ReadOnly: (documentation changed)
│         │    └ SourceVolume: (documentation changed)
│         ├[~] type NetworkConfiguration
│         │ ├  - documentation: undefined
│         │ │  + documentation: The network configuration for jobs that are running on Fargate resources. Jobs that are running on EC2 resources must not specify this parameter.
│         │ └ properties
│         │    └ AssignPublicIp: (documentation changed)
│         ├[~] type NodeProperties
│         │ ├  - documentation: undefined
│         │ │  + documentation: An object that represents the node properties of a multi-node parallel job.
│         │ │  > Node properties can't be specified for Amazon EKS based job definitions.
│         │ └ properties
│         │    ├ MainNode: (documentation changed)
│         │    ├ NodeRangeProperties: (documentation changed)
│         │    └ NumNodes: (documentation changed)
│         ├[~] type NodeRangeProperty
│         │ ├  - documentation: undefined
│         │ │  + documentation: An object that represents the properties of the node range for a multi-node parallel job.
│         │ └ properties
│         │    ├ Container: (documentation changed)
│         │    └ TargetNodes: (documentation changed)
│         ├[~] type ResourceRequirement
│         │ ├  - documentation: undefined
│         │ │  + documentation: The type and amount of a resource to assign to a container. The supported resources include `GPU` , `MEMORY` , and `VCPU` .
│         │ └ properties
│         │    ├ Type: (documentation changed)
│         │    └ Value: (documentation changed)
│         ├[~] type RetryStrategy
│         │ ├  - documentation: undefined
│         │ │  + documentation: The retry strategy that's associated with a job. For more information, see [Automated job retries](https://docs.aws.amazon.com/batch/latest/userguide/job_retries.html) in the *AWS Batch User Guide* .
│         │ └ properties
│         │    ├ Attempts: (documentation changed)
│         │    └ EvaluateOnExit: (documentation changed)
│         ├[~] type RuntimePlatform
│         │ ├  - documentation: undefined
│         │ │  + documentation: An object that represents the compute environment architecture for AWS Batch jobs on Fargate.
│         │ └ properties
│         │    ├ CpuArchitecture: (documentation changed)
│         │    └ OperatingSystemFamily: (documentation changed)
│         ├[~] type Secret
│         │ ├  - documentation: undefined
│         │ │  + documentation: An object that represents the secret to expose to your container. Secrets can be exposed to a container in the following ways:
│         │ │  - To inject sensitive data into your containers as environment variables, use the `secrets` container definition parameter.
│         │ │  - To reference sensitive information in the log configuration of a container, use the `secretOptions` container definition parameter.
│         │ │  For more information, see [Specifying sensitive data](https://docs.aws.amazon.com/batch/latest/userguide/specifying-sensitive-data.html) in the *AWS Batch User Guide* .
│         │ └ properties
│         │    ├ Name: (documentation changed)
│         │    └ ValueFrom: (documentation changed)
│         ├[~] type Timeout
│         │ ├  - documentation: undefined
│         │ │  + documentation: An object that represents a job timeout configuration.
│         │ └ properties
│         │    └ AttemptDurationSeconds: (documentation changed)
│         ├[~] type Tmpfs
│         │ ├  - documentation: undefined
│         │ │  + documentation: The container path, mount options, and size of the `tmpfs` mount.
│         │ │  > This object isn't applicable to jobs that are running on Fargate resources.
│         │ └ properties
│         │    ├ ContainerPath: (documentation changed)
│         │    ├ MountOptions: (documentation changed)
│         │    └ Size: (documentation changed)
│         ├[~] type Ulimit
│         │ ├  - documentation: undefined
│         │ │  + documentation: The `ulimit` settings to pass to the container. For more information, see [Ulimit](https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_Ulimit.html) .
│         │ │  > This object isn't applicable to jobs that are running on Fargate resources.
│         │ └ properties
│         │    ├ HardLimit: (documentation changed)
│         │    ├ Name: (documentation changed)
│         │    └ SoftLimit: (documentation changed)
│         ├[~] type Volumes
│         │ ├  - documentation: undefined
│         │ │  + documentation: A list of volumes that are associated with the job.
│         │ └ properties
│         │    ├ EfsVolumeConfiguration: (documentation changed)
│         │    ├ Host: (documentation changed)
│         │    └ Name: (documentation changed)
│         └[~] type VolumesHost
│           ├  - documentation: undefined
│           │  + documentation: Determine whether your data volume persists on the host container instance and where it's stored. If this parameter is empty, then the Docker daemon assigns a host path for your data volume. However, the data isn't guaranteed to persist after the containers that are associated with it stop running.
│           └ properties
│              └ SourcePath: (documentation changed)
├[~] service aws-cognito
│ └ resources
│    ├[~] resource AWS::Cognito::IdentityPool
│    │ └ attributes
│    │    └ Id: (documentation changed)
│    └[~] resource AWS::Cognito::IdentityPoolRoleAttachment
│      └ attributes
│         └ Id: (documentation changed)
├[~] service aws-ec2
│ └ resources
│    ├[~] resource AWS::EC2::Instance
│    │ └ properties
│    │    └ ElasticGpuSpecifications: (documentation changed)
│    ├[~] resource AWS::EC2::LaunchTemplate
│    │ └ types
│    │    ├[~] type LaunchTemplateData
│    │    │ └ properties
│    │    │    └ ElasticGpuSpecifications: (documentation changed)
│    │    └[~] type TagSpecification
│    │      └ properties
│    │         └ ResourceType: (documentation changed)
│    ├[~] resource AWS::EC2::NetworkAclEntry
│    │ ├ properties
│    │ │  ├ CidrBlock: (documentation changed)
│    │ │  ├ Icmp: (documentation changed)
│    │ │  ├ Ipv6CidrBlock: (documentation changed)
│    │ │  └ PortRange: (documentation changed)
│    │ └ types
│    │    └[~] type Icmp
│    │      └ properties
│    │         └ Code: (documentation changed)
│    ├[~] resource AWS::EC2::SecurityGroup
│    │ ├ properties
│    │ │  └ VpcId: (documentation changed)
│    │ └ types
│    │    ├[~] type Egress
│    │    │ ├  - documentation: Adds the specified egress rules to a security group for use with a VPC.
│    │    │ │  An outbound rule permits instances to send traffic to the specified destination IPv4 or IPv6 CIDR address ranges, or to the specified destination security groups for the same VPC.
│    │    │ │  You specify a protocol for each rule (for example, TCP). For the TCP and UDP protocols, you must also specify the destination port or port range. For the ICMP protocol, you must also specify the ICMP type and code. You can use -1 for the type or code to mean all types or all codes.
│    │    │ │  You must specify only one of the following properties: `CidrIp` , `CidrIpv6` , `DestinationPrefixListId` , or `DestinationSecurityGroupId` .
│    │    │ │  You must specify a destination security group ( `DestinationPrefixListId` or `DestinationSecurityGroupId` ) or a CIDR range ( `CidrIp` or `CidrIpv6` ). If you do not specify one of these parameters, the stack will launch successfully but the rule will not be added to the security group.
│    │    │ │  Rule changes are propagated to affected instances as quickly as possible. However, a small delay might occur.
│    │    │ │  For more information about VPC security group limits, see [Amazon VPC Limits](https://docs.aws.amazon.com/vpc/latest/userguide/amazon-vpc-limits.html) .
│    │    │ │  Use `SecurityGroup.Ingress` and `SecurityGroup.Egress` only when necessary, typically to allow security groups to reference each other in ingress and egress rules. Otherwise, use the embedded ingress and egress rules of the security group. For more information, see [Amazon EC2 Security Groups](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-network-security.html) .
│    │    │ │  The EC2 Security Group Rule is an embedded property of the `AWS::EC2::SecurityGroup` type.
│    │    │ │  + documentation: Adds the specified outbound (egress) rule to a security group.
│    │    │ │  An outbound rule permits instances to send traffic to the specified IPv4 or IPv6 address range, the IP address ranges that are specified by a prefix list, or the instances that are associated with a destination security group. For more information, see [Security group rules](https://docs.aws.amazon.com/vpc/latest/userguide/security-group-rules.html) .
│    │    │ │  You must specify exactly one of the following destinations: an IPv4 or IPv6 address range, a prefix list, or a security group. Otherwise, the stack launches successfully but the rule is not added to the security group.
│    │    │ │  You must specify a protocol for each rule (for example, TCP). If the protocol is TCP or UDP, you must also specify a port or port range. If the protocol is ICMP or ICMPv6, you must also specify the ICMP/ICMPv6 type and code.
│    │    │ │  Rule changes are propagated to instances associated with the security group as quickly as possible. However, a small delay might occur.
│    │    │ └ properties
│    │    │    ├ FromPort: (documentation changed)
│    │    │    └ ToPort: (documentation changed)
│    │    └[~] type Ingress
│    │      ├  - documentation: Adds an inbound rule to a security group.
│    │      │  An inbound rule permits instances to receive traffic from the specified IPv4 or IPv6 CIDR address range, or from the instances associated with the specified security group.
│    │      │  You must specify only one of the following properties: `CidrIp` , `CidrIpv6` , `SourcePrefixListId` , `SourceSecurityGroupId` , or `SourceSecurityGroupName` .
│    │      │  You specify a protocol for each rule (for example, TCP). For TCP and UDP, you must also specify a port or port range. For ICMP/ICMPv6, you must also specify the ICMP/ICMPv6 type and code. You can use -1 to mean all types or all codes.
│    │      │  You must specify a source security group ( `SourcePrefixListId` , `SourceSecurityGroupId` , or `SourceSecurityGroupName` ) or a CIDR range ( `CidrIp` or `CidrIpv6` ). If you do not specify one of these parameters, the stack will launch successfully but the rule will not be added to the security group.
│    │      │  Rule changes are propagated to instances within the security group as quickly as possible. However, a small delay might occur.
│    │      │  The EC2 Security Group Rule is an embedded property of the `AWS::EC2::SecurityGroup` type.
│    │      │  + documentation: Adds an inbound (ingress) rule to a security group.
│    │      │  An inbound rule permits instances to receive traffic from the specified IPv4 or IPv6 address range, the IP address ranges that are specified by a prefix list, or the instances that are associated with a source security group. For more information, see [Security group rules](https://docs.aws.amazon.com/vpc/latest/userguide/security-group-rules.html) .
│    │      │  You must specify exactly one of the following sources: an IPv4 or IPv6 address range, a prefix list, or a security group. Otherwise, the stack launches successfully, but the rule is not added to the security group.
│    │      │  You must specify a protocol for each rule (for example, TCP). If the protocol is TCP or UDP, you must also specify a port or port range. If the protocol is ICMP or ICMPv6, you must also specify the ICMP/ICMPv6 type and code.
│    │      │  Rule changes are propagated to instances associated with the security group as quickly as possible. However, a small delay might occur.
│    │      └ properties
│    │         ├ FromPort: (documentation changed)
│    │         ├ SourceSecurityGroupId: (documentation changed)
│    │         └ ToPort: (documentation changed)
│    ├[~] resource AWS::EC2::SecurityGroupEgress
│    │ ├  - documentation: Adds the specified egress rules to a security group.
│    │ │  An outbound rule permits instances to send traffic to the specified destination IPv4 or IPv6 CIDR address ranges, or to the specified destination security groups for the same VPC.
│    │ │  You specify a protocol for each rule (for example, TCP). For the TCP and UDP protocols, you must also specify the destination port or port range. For the ICMP protocol, you must also specify the ICMP type and code. You can use -1 for the type or code to mean all types or all codes.
│    │ │  You must specify only one of the following properties: `CidrIp` , `CidrIpv6` , `DestinationPrefixListId` , or `DestinationSecurityGroupId` .
│    │ │  You must specify a destination security group ( `DestinationPrefixListId` or `DestinationSecurityGroupId` ) or a CIDR range ( `CidrIp` or `CidrIpv6` ). If you do not specify one of these parameters, the stack will launch successfully but the rule will not be added to the security group.
│    │ │  Rule changes are propagated to affected instances as quickly as possible. However, a small delay might occur.
│    │ │  For more information about VPC security group limits, see [Amazon VPC Limits](https://docs.aws.amazon.com/vpc/latest/userguide/amazon-vpc-limits.html) .
│    │ │  Use `AWS::EC2::SecurityGroupIngress` and `AWS::EC2::SecurityGroupEgress` only when necessary, typically to allow security groups to reference each other in ingress and egress rules. Otherwise, use the embedded ingress and egress rules of the security group. For more information, see [Amazon EC2 Security Groups](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-network-security.html) .
│    │ │  + documentation: Adds the specified outbound (egress) rule to a security group.
│    │ │  An outbound rule permits instances to send traffic to the specified IPv4 or IPv6 address range, the IP addresses that are specified by a prefix list, or the instances that are associated with a destination security group. For more information, see [Security group rules](https://docs.aws.amazon.com/vpc/latest/userguide/security-group-rules.html) .
│    │ │  You must specify exactly one of the following destinations: an IPv4 or IPv6 address range, a prefix list, or a security group. Otherwise, the stack launches successfully but the rule is not added to the security group.
│    │ │  You must specify a protocol for each rule (for example, TCP). If the protocol is TCP or UDP, you must also specify a port or port range. If the protocol is ICMP or ICMPv6, you must also specify the ICMP/ICMPv6 type and code. To specify all types or all codes, use -1.
│    │ │  Rule changes are propagated to instances associated with the security group as quickly as possible. However, a small delay might occur.
│    │ └ properties
│    │    ├ FromPort: (documentation changed)
│    │    └ ToPort: (documentation changed)
│    ├[~] resource AWS::EC2::SecurityGroupIngress
│    │ └  - documentation: Adds an inbound rule to a security group.
│    │    An inbound rule permits instances to receive traffic from the specified IPv4 or IPv6 CIDR address range, or from the instances associated with the specified security group.
│    │    You must specify only one of the following properties: `CidrIp` , `CidrIpv6` , `SourcePrefixListId` , `SourceSecurityGroupId` , or `SourceSecurityGroupName` .
│    │    You specify a protocol for each rule (for example, TCP). For TCP and UDP, you must also specify a port or port range. For ICMP/ICMPv6, you must also specify the ICMP/ICMPv6 type and code. You can use -1 to mean all types or all codes.
│    │    You must specify a source security group ( `SourcePrefixListId` , `SourceSecurityGroupId` , or `SourceSecurityGroupName` ) or a CIDR range ( `CidrIp` or `CidrIpv6` ). If you do not specify one of these parameters, the stack will launch successfully but the rule will not be added to the security group.
│    │    Rule changes are propagated to instances within the security group as quickly as possible. However, a small delay might occur.
│    │    + documentation: Adds an inbound (ingress) rule to a security group.
│    │    An inbound rule permits instances to receive traffic from the specified IPv4 or IPv6 address range, the IP addresses that are specified by a prefix list, or the instances that are associated with a source security group. For more information, see [Security group rules](https://docs.aws.amazon.com/vpc/latest/userguide/security-group-rules.html) .
│    │    You must specify only one of the following sources: an IPv4 or IPv6 address range, a prefix list, or a security group. Otherwise, the stack launches successfully, but the rule is not added to the security group.
│    │    You must specify a protocol for each rule (for example, TCP). If the protocol is TCP or UDP, you must also specify a port or port range. If the protocol is ICMP or ICMPv6, you must also specify the ICMP/ICMPv6 type and code.
│    │    Rule changes are propagated to instances associated with the security group as quickly as possible. However, a small delay might occur.
│    ├[~] resource AWS::EC2::Subnet
│    │ └ properties
│    │    ├ AssignIpv6AddressOnCreation: (documentation changed)
│    │    ├ Ipv6CidrBlock: (documentation changed)
│    │    └ Ipv6CidrBlocks: (documentation changed)
│    └[~] resource AWS::EC2::SubnetCidrBlock
│      └ properties
│         └ Ipv6CidrBlock: (documentation changed)
├[~] service aws-internetmonitor
│ └ resources
│    └[~] resource AWS::InternetMonitor::Monitor
│      └ types
│         ├[~] type InternetMeasurementsLogDelivery
│         │ └ properties
│         │    └ S3Config: (documentation changed)
│         └[~] type S3Config
│           ├  - documentation: The configuration for publishing Amazon CloudWatch Internet Monitor internet measurements to Amazon S3. The configuration includes the bucket name and (optionally) prefix for the S3 bucket to store the measurements, and the delivery status. The delivery status is `ENABLED` or `DISABLED` , depending on whether you choose to deliver internet measurements to S3 logs.
│           │  + documentation: The configuration for publishing Amazon CloudWatch Internet Monitor internet measurements to Amazon S3. The configuration includes the bucket name and (optionally) bucket prefix for the S3 bucket to store the measurements, and the delivery status. The delivery status is `ENABLED` if you choose to deliver internet measurements to S3 logs, and `DISABLED` otherwise.
│           │  The measurements are also published to Amazon CloudWatch Logs.
│           └ properties
│              ├ BucketName: (documentation changed)
│              ├ BucketPrefix: (documentation changed)
│              └ LogDeliveryStatus: (documentation changed)
├[~] service aws-lakeformation
│ └ resources
│    └[~] resource AWS::LakeFormation::Resource
│      └ properties
│         └ HybridAccessEnabled: (documentation changed)
├[~] service aws-networkmanager
│ └ resources
│    └[~] resource AWS::NetworkManager::Device
│      └ attributes
│         └ CreatedAt: (documentation changed)
├[~] service aws-rolesanywhere
│ └ resources
│    ├[~] resource AWS::RolesAnywhere::Profile
│    │ ├  - documentation: Creates a *profile* , a list of the roles that Roles Anywhere service is trusted to assume. You use profiles to intersect permissions with IAM managed policies.
│    │ │  *Required permissions:* `rolesanywhere:CreateProfile` .
│    │ │  + documentation: Creates a Profile.
│    │ └ properties
│    │    ├ DurationSeconds: (documentation changed)
│    │    ├ Enabled: (documentation changed)
│    │    ├ ManagedPolicyArns: (documentation changed)
│    │    ├ Name: (documentation changed)
│    │    ├ RequireInstanceProperties: (documentation changed)
│    │    ├ RoleArns: (documentation changed)
│    │    ├ SessionPolicy: (documentation changed)
│    │    └ Tags: (documentation changed)
│    └[~] resource AWS::RolesAnywhere::TrustAnchor
│      ├  - documentation: Creates a trust anchor to establish trust between IAM Roles Anywhere and your certificate authority (CA). You can define a trust anchor as a reference to an AWS Private Certificate Authority ( AWS Private CA ) or by uploading a CA certificate. Your AWS workloads can authenticate with the trust anchor using certificates issued by the CA in exchange for temporary AWS credentials.
│      │  *Required permissions:* `rolesanywhere:CreateTrustAnchor` .
│      │  + documentation: Creates a TrustAnchor.
│      └ types
│         ├[~] type Source
│         │ ├  - documentation: The trust anchor type and its related certificate data.
│         │ │  + documentation: Object representing the TrustAnchor type and its related certificate data.
│         │ └ properties
│         │    ├ SourceData: (documentation changed)
│         │    └ SourceType: (documentation changed)
│         └[~] type SourceData
│           └  - documentation: The data field of the trust anchor depending on its type.
│              + documentation: A union object representing the data field of the TrustAnchor depending on its type
└[~] service aws-route53resolver
  └ resources
     └[~] resource AWS::Route53Resolver::FirewallRuleGroup
       └ types
          └[~] type FirewallRule
            └ properties
               └ Qtype: (documentation changed)