|
369 | 369 | {"shape":"InvalidKMSArn"}, |
370 | 370 | {"shape":"InvalidInput"} |
371 | 371 | ], |
372 | | - "documentation":"<p>Deletes a key-signing key (KSK). Before you can delete a KSK, you must deactivate it. The KSK must be deactivated before you can delete it regardless of whether the hosted zone is enabled for DNSSEC signing.</p>" |
| 372 | + "documentation":"<p>Deletes a key-signing key (KSK). Before you can delete a KSK, you must deactivate it. The KSK must be deactivated before you can delete it regardless of whether the hosted zone is enabled for DNSSEC signing.</p> <p>You can use <a href=\"https://docs.aws.amazon.com/Route53/latest/APIReference/API_DeactivateKeySigningKey.html\">DeactivateKeySigningKey</a> to deactivate the key before you delete it.</p> <p>Use <a href=\"https://docs.aws.amazon.com/Route53/latest/APIReference/API_GetDNSSEC.html\">GetDNSSEC</a> to verify that the KSK is in an <code>INACTIVE</code> status.</p>" |
373 | 373 | }, |
374 | 374 | "DeleteQueryLoggingConfig":{ |
375 | 375 | "name":"DeleteQueryLoggingConfig", |
|
1041 | 1041 | "output":{"shape":"UpdateHostedZoneCommentResponse"}, |
1042 | 1042 | "errors":[ |
1043 | 1043 | {"shape":"NoSuchHostedZone"}, |
1044 | | - {"shape":"InvalidInput"} |
| 1044 | + {"shape":"InvalidInput"}, |
| 1045 | + {"shape":"PriorRequestNotComplete"} |
1045 | 1046 | ], |
1046 | 1047 | "documentation":"<p>Updates the comment for a specified hosted zone.</p>" |
1047 | 1048 | }, |
|
1454 | 1455 | "ap-south-1", |
1455 | 1456 | "ap-southeast-1", |
1456 | 1457 | "ap-southeast-2", |
| 1458 | + "ap-southeast-3", |
1457 | 1459 | "ap-northeast-1", |
1458 | 1460 | "ap-northeast-2", |
1459 | 1461 | "ap-northeast-3", |
|
1466 | 1468 | "us-gov-west-1", |
1467 | 1469 | "us-gov-east-1", |
1468 | 1470 | "us-iso-east-1", |
| 1471 | + "us-iso-west-1", |
1469 | 1472 | "us-isob-east-1" |
1470 | 1473 | ], |
1471 | 1474 | "max":64, |
|
1563 | 1566 | }, |
1564 | 1567 | "VPC":{ |
1565 | 1568 | "shape":"VPC", |
1566 | | - "documentation":"<p>(Private hosted zones only) A complex type that contains information about the Amazon VPC that you're associating with this hosted zone.</p> <p>You can specify only one Amazon VPC when you create a private hosted zone. To associate additional Amazon VPCs with the hosted zone, use <a href=\"https://docs.aws.amazon.com/Route53/latest/APIReference/API_AssociateVPCWithHostedZone.html\">AssociateVPCWithHostedZone</a> after you create a hosted zone.</p>" |
| 1569 | + "documentation":"<p>(Private hosted zones only) A complex type that contains information about the Amazon VPC that you're associating with this hosted zone.</p> <p>You can specify only one Amazon VPC when you create a private hosted zone. If you are associating a VPC with a hosted zone with this request, the paramaters <code>VPCId</code> and <code>VPCRegion</code> are also required.</p> <p>To associate additional Amazon VPCs with the hosted zone, use <a href=\"https://docs.aws.amazon.com/Route53/latest/APIReference/API_AssociateVPCWithHostedZone.html\">AssociateVPCWithHostedZone</a> after you create a hosted zone.</p>" |
1567 | 1570 | }, |
1568 | 1571 | "CallerReference":{ |
1569 | 1572 | "shape":"Nonce", |
|
1634 | 1637 | }, |
1635 | 1638 | "KeyManagementServiceArn":{ |
1636 | 1639 | "shape":"SigningKeyString", |
1637 | | - "documentation":"<p>The Amazon resource name (ARN) for a customer managed customer master key (CMK) in Key Management Service (KMS). The <code>KeyManagementServiceArn</code> must be unique for each key-signing key (KSK) in a single hosted zone. To see an example of <code>KeyManagementServiceArn</code> that grants the correct permissions for DNSSEC, scroll down to <b>Example</b>. </p> <p>You must configure the customer managed CMK as follows:</p> <dl> <dt>Status</dt> <dd> <p>Enabled</p> </dd> <dt>Key spec</dt> <dd> <p>ECC_NIST_P256</p> </dd> <dt>Key usage</dt> <dd> <p>Sign and verify</p> </dd> <dt>Key policy</dt> <dd> <p>The key policy must give permission for the following actions:</p> <ul> <li> <p>DescribeKey</p> </li> <li> <p>GetPublicKey</p> </li> <li> <p>Sign</p> </li> </ul> <p>The key policy must also include the Amazon Route 53 service in the principal for your account. Specify the following:</p> <ul> <li> <p> <code>\"Service\": \"dnssec-route53.amazonaws.com\"</code> </p> </li> </ul> </dd> </dl> <p>For more information about working with a customer managed CMK in KMS, see <a href=\"https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html\">Key Management Service concepts</a>.</p>" |
| 1640 | + "documentation":"<p>The Amazon resource name (ARN) for a customer managed key in Key Management Service (KMS). The <code>KeyManagementServiceArn</code> must be unique for each key-signing key (KSK) in a single hosted zone. To see an example of <code>KeyManagementServiceArn</code> that grants the correct permissions for DNSSEC, scroll down to <b>Example</b>. </p> <p>You must configure the customer managed customer managed key as follows:</p> <dl> <dt>Status</dt> <dd> <p>Enabled</p> </dd> <dt>Key spec</dt> <dd> <p>ECC_NIST_P256</p> </dd> <dt>Key usage</dt> <dd> <p>Sign and verify</p> </dd> <dt>Key policy</dt> <dd> <p>The key policy must give permission for the following actions:</p> <ul> <li> <p>DescribeKey</p> </li> <li> <p>GetPublicKey</p> </li> <li> <p>Sign</p> </li> </ul> <p>The key policy must also include the Amazon Route 53 service in the principal for your account. Specify the following:</p> <ul> <li> <p> <code>\"Service\": \"dnssec-route53.amazonaws.com\"</code> </p> </li> </ul> </dd> </dl> <p>For more information about working with a customer managed key in KMS, see <a href=\"https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html\">Key Management Service concepts</a>.</p>" |
1638 | 1641 | }, |
1639 | 1642 | "Name":{ |
1640 | 1643 | "shape":"SigningKeyName", |
|
1932 | 1935 | "members":{ |
1933 | 1936 | "ServeSignature":{ |
1934 | 1937 | "shape":"ServeSignature", |
1935 | | - "documentation":"<p>A string that represents the current hosted zone signing status.</p> <p>Status can have one of the following values:</p> <dl> <dt>SIGNING</dt> <dd> <p>DNSSEC signing is enabled for the hosted zone.</p> </dd> <dt>NOT_SIGNING</dt> <dd> <p>DNSSEC signing is not enabled for the hosted zone.</p> </dd> <dt>DELETING</dt> <dd> <p>DNSSEC signing is in the process of being removed for the hosted zone.</p> </dd> <dt>ACTION_NEEDED</dt> <dd> <p>There is a problem with signing in the hosted zone that requires you to take action to resolve. For example, the customer managed customer master key (CMK) might have been deleted, or the permissions for the customer managed CMK might have been changed.</p> </dd> <dt>INTERNAL_FAILURE</dt> <dd> <p>There was an error during a request. Before you can continue to work with DNSSEC signing, including with key-signing keys (KSKs), you must correct the problem by enabling or disabling DNSSEC signing for the hosted zone.</p> </dd> </dl>" |
| 1938 | + "documentation":"<p>A string that represents the current hosted zone signing status.</p> <p>Status can have one of the following values:</p> <dl> <dt>SIGNING</dt> <dd> <p>DNSSEC signing is enabled for the hosted zone.</p> </dd> <dt>NOT_SIGNING</dt> <dd> <p>DNSSEC signing is not enabled for the hosted zone.</p> </dd> <dt>DELETING</dt> <dd> <p>DNSSEC signing is in the process of being removed for the hosted zone.</p> </dd> <dt>ACTION_NEEDED</dt> <dd> <p>There is a problem with signing in the hosted zone that requires you to take action to resolve. For example, the customer managed key might have been deleted, or the permissions for the customer managed key might have been changed.</p> </dd> <dt>INTERNAL_FAILURE</dt> <dd> <p>There was an error during a request. Before you can continue to work with DNSSEC signing, including with key-signing keys (KSKs), you must correct the problem by enabling or disabling DNSSEC signing for the hosted zone.</p> </dd> </dl>" |
1936 | 1939 | }, |
1937 | 1940 | "StatusMessage":{ |
1938 | 1941 | "shape":"SigningKeyStatusMessage", |
|
3504 | 3507 | }, |
3505 | 3508 | "KmsArn":{ |
3506 | 3509 | "shape":"SigningKeyString", |
3507 | | - "documentation":"<p>The Amazon resource name (ARN) used to identify the customer managed customer master key (CMK) in Key Management Service (KMS). The <code>KmsArn</code> must be unique for each key-signing key (KSK) in a single hosted zone.</p> <p>You must configure the CMK as follows:</p> <dl> <dt>Status</dt> <dd> <p>Enabled</p> </dd> <dt>Key spec</dt> <dd> <p>ECC_NIST_P256</p> </dd> <dt>Key usage</dt> <dd> <p>Sign and verify</p> </dd> <dt>Key policy</dt> <dd> <p>The key policy must give permission for the following actions:</p> <ul> <li> <p>DescribeKey</p> </li> <li> <p>GetPublicKey</p> </li> <li> <p>Sign</p> </li> </ul> <p>The key policy must also include the Amazon Route 53 service in the principal for your account. Specify the following:</p> <ul> <li> <p> <code>\"Service\": \"dnssec-route53.amazonaws.com\"</code> </p> </li> </ul> </dd> </dl> <p>For more information about working with the customer managed CMK in KMS, see <a href=\"https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html\">Key Management Service concepts</a>.</p>" |
| 3510 | + "documentation":"<p>The Amazon resource name (ARN) used to identify the customer managed key in Key Management Service (KMS). The <code>KmsArn</code> must be unique for each key-signing key (KSK) in a single hosted zone.</p> <p>You must configure the customer managed key as follows:</p> <dl> <dt>Status</dt> <dd> <p>Enabled</p> </dd> <dt>Key spec</dt> <dd> <p>ECC_NIST_P256</p> </dd> <dt>Key usage</dt> <dd> <p>Sign and verify</p> </dd> <dt>Key policy</dt> <dd> <p>The key policy must give permission for the following actions:</p> <ul> <li> <p>DescribeKey</p> </li> <li> <p>GetPublicKey</p> </li> <li> <p>Sign</p> </li> </ul> <p>The key policy must also include the Amazon Route 53 service in the principal for your account. Specify the following:</p> <ul> <li> <p> <code>\"Service\": \"dnssec-route53.amazonaws.com\"</code> </p> </li> </ul> </dd> </dl> <p>For more information about working with the customer managed key in KMS, see <a href=\"https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html\">Key Management Service concepts</a>.</p>" |
3508 | 3511 | }, |
3509 | 3512 | "Flag":{ |
3510 | 3513 | "shape":"SigningKeyInteger", |
|
3548 | 3551 | }, |
3549 | 3552 | "Status":{ |
3550 | 3553 | "shape":"SigningKeyStatus", |
3551 | | - "documentation":"<p>A string that represents the current key-signing key (KSK) status.</p> <p>Status can have one of the following values:</p> <dl> <dt>ACTIVE</dt> <dd> <p>The KSK is being used for signing.</p> </dd> <dt>INACTIVE</dt> <dd> <p>The KSK is not being used for signing.</p> </dd> <dt>DELETING</dt> <dd> <p>The KSK is in the process of being deleted.</p> </dd> <dt>ACTION_NEEDED</dt> <dd> <p>There is a problem with the KSK that requires you to take action to resolve. For example, the customer managed customer master key (CMK) might have been deleted, or the permissions for the customer managed CMK might have been changed.</p> </dd> <dt>INTERNAL_FAILURE</dt> <dd> <p>There was an error during a request. Before you can continue to work with DNSSEC signing, including actions that involve this KSK, you must correct the problem. For example, you may need to activate or deactivate the KSK.</p> </dd> </dl>" |
| 3554 | + "documentation":"<p>A string that represents the current key-signing key (KSK) status.</p> <p>Status can have one of the following values:</p> <dl> <dt>ACTIVE</dt> <dd> <p>The KSK is being used for signing.</p> </dd> <dt>INACTIVE</dt> <dd> <p>The KSK is not being used for signing.</p> </dd> <dt>DELETING</dt> <dd> <p>The KSK is in the process of being deleted.</p> </dd> <dt>ACTION_NEEDED</dt> <dd> <p>There is a problem with the KSK that requires you to take action to resolve. For example, the customer managed key might have been deleted, or the permissions for the customer managed key might have been changed.</p> </dd> <dt>INTERNAL_FAILURE</dt> <dd> <p>There was an error during a request. Before you can continue to work with DNSSEC signing, including actions that involve this KSK, you must correct the problem. For example, you may need to activate or deactivate the KSK.</p> </dd> </dl>" |
3552 | 3555 | }, |
3553 | 3556 | "StatusMessage":{ |
3554 | 3557 | "shape":"SigningKeyStatusMessage", |
|
3570 | 3573 | "members":{ |
3571 | 3574 | "message":{"shape":"ErrorMessage"} |
3572 | 3575 | }, |
3573 | | - "documentation":"<p>You've already created a key-signing key (KSK) with this name or with the same customer managed customer master key (CMK) ARN.</p>", |
| 3576 | + "documentation":"<p>You've already created a key-signing key (KSK) with this name or with the same customer managed key ARN.</p>", |
3574 | 3577 | "error":{"httpStatusCode":409}, |
3575 | 3578 | "exception":true |
3576 | 3579 | }, |
|
4909 | 4912 | "eu-central-1", |
4910 | 4913 | "ap-southeast-1", |
4911 | 4914 | "ap-southeast-2", |
| 4915 | + "ap-southeast-3", |
4912 | 4916 | "ap-northeast-1", |
4913 | 4917 | "ap-northeast-2", |
4914 | 4918 | "ap-northeast-3", |
|
5585 | 5589 | }, |
5586 | 5590 | "InsufficientDataHealthStatus":{ |
5587 | 5591 | "shape":"InsufficientDataHealthStatus", |
5588 | | - "documentation":"<p>When CloudWatch has insufficient data about the metric to determine the alarm state, the status that you want Amazon Route 53 to assign to the health check:</p> <ul> <li> <p> <code>Healthy</code>: Route 53 considers the health check to be healthy.</p> </li> <li> <p> <code>Unhealthy</code>: Route 53 considers the health check to be unhealthy.</p> </li> <li> <p> <code>LastKnownStatus</code>: Route 53 uses the status of the health check from the last time CloudWatch had sufficient data to determine the alarm state. For new health checks that have no last known status, the default status for the health check is healthy.</p> </li> </ul>" |
| 5592 | + "documentation":"<p>When CloudWatch has insufficient data about the metric to determine the alarm state, the status that you want Amazon Route 53 to assign to the health check:</p> <ul> <li> <p> <code>Healthy</code>: Route 53 considers the health check to be healthy.</p> </li> <li> <p> <code>Unhealthy</code>: Route 53 considers the health check to be unhealthy.</p> </li> <li> <p> <code>LastKnownStatus</code>: By default, Route 53 uses the status of the health check from the last time CloudWatch had sufficient data to determine the alarm state. For new health checks that have no last known status, the status for the health check is healthy.</p> </li> </ul>" |
5589 | 5593 | }, |
5590 | 5594 | "ResetElements":{ |
5591 | 5595 | "shape":"ResettableElementNameList", |
|
5725 | 5729 | }, |
5726 | 5730 | "VPCId":{"shape":"VPCId"} |
5727 | 5731 | }, |
5728 | | - "documentation":"<p>(Private hosted zones only) A complex type that contains information about an Amazon VPC.</p>" |
| 5732 | + "documentation":"<p>(Private hosted zones only) A complex type that contains information about an Amazon VPC.</p> <p>If you associate a private hosted zone with an Amazon VPC when you make a <a href=\"https://docs.aws.amazon.com/Route53/latest/APIReference/API_CreateHostedZone.html\">CreateHostedZone</a> request, the following parameters are also required.</p>" |
5729 | 5733 | }, |
5730 | 5734 | "VPCAssociationAuthorizationNotFound":{ |
5731 | 5735 | "type":"structure", |
|
5772 | 5776 | "us-gov-west-1", |
5773 | 5777 | "us-gov-east-1", |
5774 | 5778 | "us-iso-east-1", |
| 5779 | + "us-iso-west-1", |
5775 | 5780 | "us-isob-east-1", |
5776 | 5781 | "ap-southeast-1", |
5777 | 5782 | "ap-southeast-2", |
| 5783 | + "ap-southeast-3", |
5778 | 5784 | "ap-south-1", |
5779 | 5785 | "ap-northeast-1", |
5780 | 5786 | "ap-northeast-2", |
|
0 commit comments