diff --git a/CHANGELOG.md b/CHANGELOG.md
index 98839d7f224..0a63a0621ad 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,16 @@
+Release v1.51.18 (2024-04-09)
+===
+
+### Service Client Updates
+* `service/codebuild`: Updates service API and documentation
+  * Add new webhook filter types for GitHub webhooks
+* `service/mediaconvert`: Updates service API and documentation
+  * This release includes support for bringing your own fonts to use for burn-in or DVB-Sub captioning workflows.
+* `service/pinpoint`: Updates service API and documentation
+  * The OrchestrationSendingRoleArn has been added to the email channel and is used to send emails from campaigns or journeys.
+* `service/rds`: Updates service API, documentation, waiters, paginators, and examples
+  * This release adds support for specifying the CA certificate to use for the new db instance when restoring from db snapshot, restoring from s3, restoring to point in time, and creating a db instance read replica.
+
 Release v1.51.17 (2024-04-08)
 ===
 
diff --git a/aws/endpoints/defaults.go b/aws/endpoints/defaults.go
index efc6ff5fdfc..dce59e4695a 100644
--- a/aws/endpoints/defaults.go
+++ b/aws/endpoints/defaults.go
@@ -25379,6 +25379,12 @@ var awsPartition = partition{
 		},
 		"resource-explorer-2": service{
 			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "af-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-east-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-northeast-1",
 				}: endpoint{},
@@ -25391,6 +25397,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -25400,15 +25409,30 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ca-west-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-1",
 				}: endpoint{},
@@ -25418,6 +25442,12 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "me-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-south-1",
 				}: endpoint{},
diff --git a/aws/version.go b/aws/version.go
index aa917adc02c..05d4b65fd2a 100644
--- a/aws/version.go
+++ b/aws/version.go
@@ -5,4 +5,4 @@ package aws
 const SDKName = "aws-sdk-go"
 
 // SDKVersion is the version of this SDK
-const SDKVersion = "1.51.17"
+const SDKVersion = "1.51.18"
diff --git a/models/apis/codebuild/2016-10-06/api-2.json b/models/apis/codebuild/2016-10-06/api-2.json
index 0c3f84ba3a8..4caf08a67a7 100644
--- a/models/apis/codebuild/2016-10-06/api-2.json
+++ b/models/apis/codebuild/2016-10-06/api-2.json
@@ -2863,7 +2863,10 @@
         "HEAD_REF",
         "ACTOR_ACCOUNT_ID",
         "FILE_PATH",
-        "COMMIT_MESSAGE"
+        "COMMIT_MESSAGE",
+        "WORKFLOW_NAME",
+        "TAG_NAME",
+        "RELEASE_NAME"
       ]
     },
     "WrapperBoolean":{"type":"boolean"},
diff --git a/models/apis/codebuild/2016-10-06/docs-2.json b/models/apis/codebuild/2016-10-06/docs-2.json
index 42e5b06404c..e242f2c4de1 100644
--- a/models/apis/codebuild/2016-10-06/docs-2.json
+++ b/models/apis/codebuild/2016-10-06/docs-2.json
@@ -1798,7 +1798,7 @@
         "ProjectFileSystemLocation$identifier": "<p>The name used to access a file system created by Amazon EFS. CodeBuild creates an environment variable by appending the <code>identifier</code> in all capital letters to <code>CODEBUILD_</code>. For example, if you specify <code>my_efs</code> for <code>identifier</code>, a new environment variable is create named <code>CODEBUILD_MY_EFS</code>. </p> <p> The <code>identifier</code> is used to mount your file system. </p>",
         "ProjectFileSystemLocation$mountOptions": "<p> The mount options for a file system created by Amazon EFS. The default mount options used by CodeBuild are <code>nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2</code>. For more information, see <a href=\"https://docs.aws.amazon.com/efs/latest/ug/mounting-fs-nfs-mount-settings.html\">Recommended NFS Mount Options</a>. </p>",
         "ProjectFleet$fleetArn": "<p>Specifies the compute fleet ARN for the build project.</p>",
-        "ProjectSource$location": "<p>Information about the location of the source code to be built. Valid values include:</p> <ul> <li> <p>For source code settings that are specified in the source action of a pipeline in CodePipeline, <code>location</code> should not be specified. If it is specified, CodePipeline ignores it. This is because CodePipeline uses the settings in a pipeline's source action instead of this value.</p> </li> <li> <p>For source code in an CodeCommit repository, the HTTPS clone URL to the repository that contains the source code and the buildspec file (for example, <code>https://git-codecommit.&lt;region-ID&gt;.amazonaws.com/v1/repos/&lt;repo-name&gt;</code>).</p> </li> <li> <p>For source code in an Amazon S3 input bucket, one of the following. </p> <ul> <li> <p>The path to the ZIP file that contains the source code (for example, <code>&lt;bucket-name&gt;/&lt;path&gt;/&lt;object-name&gt;.zip</code>). </p> </li> <li> <p>The path to the folder that contains the source code (for example, <code>&lt;bucket-name&gt;/&lt;path-to-source-code&gt;/&lt;folder&gt;/</code>). </p> </li> </ul> </li> <li> <p>For source code in a GitHub repository, the HTTPS clone URL to the repository that contains the source and the buildspec file. You must connect your Amazon Web Services account to your GitHub account. Use the CodeBuild console to start creating a build project. When you use the console to connect (or reconnect) with GitHub, on the GitHub <b>Authorize application</b> page, for <b>Organization access</b>, choose <b>Request access</b> next to each repository you want to allow CodeBuild to have access to, and then choose <b>Authorize application</b>. (After you have connected to your GitHub account, you do not need to finish creating the build project. You can leave the CodeBuild console.) To instruct CodeBuild to use this connection, in the <code>source</code> object, set the <code>auth</code> object's <code>type</code> value to <code>OAUTH</code>.</p> </li> <li> <p>For source code in an GitLab or self-managed GitLab repository, the HTTPS clone URL to the repository that contains the source and the buildspec file. You must connect your Amazon Web Services account to your GitLab account. Use the CodeBuild console to start creating a build project. When you use the console to connect (or reconnect) with GitLab, on the Connections <b>Authorize application</b> page, choose <b>Authorize</b>. Then on the CodeStar Connections <b>Create GitLab connection</b> page, choose <b>Connect to GitLab</b>. (After you have connected to your GitLab account, you do not need to finish creating the build project. You can leave the CodeBuild console.) To instruct CodeBuild to override the default connection and use this connection instead, set the <code>auth</code> object's <code>type</code> value to <code>CODECONNECTIONS</code> in the <code>source</code> object.</p> </li> <li> <p>For source code in a Bitbucket repository, the HTTPS clone URL to the repository that contains the source and the buildspec file. You must connect your Amazon Web Services account to your Bitbucket account. Use the CodeBuild console to start creating a build project. When you use the console to connect (or reconnect) with Bitbucket, on the Bitbucket <b>Confirm access to your account</b> page, choose <b>Grant access</b>. (After you have connected to your Bitbucket account, you do not need to finish creating the build project. You can leave the CodeBuild console.) To instruct CodeBuild to use this connection, in the <code>source</code> object, set the <code>auth</code> object's <code>type</code> value to <code>OAUTH</code>.</p> </li> </ul> <p> If you specify <code>CODEPIPELINE</code> for the <code>Type</code> property, don't specify this property. For all of the other types, you must specify <code>Location</code>. </p>",
+        "ProjectSource$location": "<p>Information about the location of the source code to be built. Valid values include:</p> <ul> <li> <p>For source code settings that are specified in the source action of a pipeline in CodePipeline, <code>location</code> should not be specified. If it is specified, CodePipeline ignores it. This is because CodePipeline uses the settings in a pipeline's source action instead of this value.</p> </li> <li> <p>For source code in an CodeCommit repository, the HTTPS clone URL to the repository that contains the source code and the buildspec file (for example, <code>https://git-codecommit.&lt;region-ID&gt;.amazonaws.com/v1/repos/&lt;repo-name&gt;</code>).</p> </li> <li> <p>For source code in an Amazon S3 input bucket, one of the following. </p> <ul> <li> <p>The path to the ZIP file that contains the source code (for example, <code>&lt;bucket-name&gt;/&lt;path&gt;/&lt;object-name&gt;.zip</code>). </p> </li> <li> <p>The path to the folder that contains the source code (for example, <code>&lt;bucket-name&gt;/&lt;path-to-source-code&gt;/&lt;folder&gt;/</code>). </p> </li> </ul> </li> <li> <p>For source code in a GitHub repository, the HTTPS clone URL to the repository that contains the source and the buildspec file. You must connect your Amazon Web Services account to your GitHub account. Use the CodeBuild console to start creating a build project. When you use the console to connect (or reconnect) with GitHub, on the GitHub <b>Authorize application</b> page, for <b>Organization access</b>, choose <b>Request access</b> next to each repository you want to allow CodeBuild to have access to, and then choose <b>Authorize application</b>. (After you have connected to your GitHub account, you do not need to finish creating the build project. You can leave the CodeBuild console.) To instruct CodeBuild to use this connection, in the <code>source</code> object, set the <code>auth</code> object's <code>type</code> value to <code>OAUTH</code>.</p> </li> <li> <p>For source code in an GitLab or self-managed GitLab repository, the HTTPS clone URL to the repository that contains the source and the buildspec file. You must connect your Amazon Web Services account to your GitLab account. Use the CodeBuild console to start creating a build project. When you use the console to connect (or reconnect) with GitLab, on the Connections <b>Authorize application</b> page, choose <b>Authorize</b>. Then on the CodeConnections <b>Create GitLab connection</b> page, choose <b>Connect to GitLab</b>. (After you have connected to your GitLab account, you do not need to finish creating the build project. You can leave the CodeBuild console.) To instruct CodeBuild to override the default connection and use this connection instead, set the <code>auth</code> object's <code>type</code> value to <code>CODECONNECTIONS</code> in the <code>source</code> object.</p> </li> <li> <p>For source code in a Bitbucket repository, the HTTPS clone URL to the repository that contains the source and the buildspec file. You must connect your Amazon Web Services account to your Bitbucket account. Use the CodeBuild console to start creating a build project. When you use the console to connect (or reconnect) with Bitbucket, on the Bitbucket <b>Confirm access to your account</b> page, choose <b>Grant access</b>. (After you have connected to your Bitbucket account, you do not need to finish creating the build project. You can leave the CodeBuild console.) To instruct CodeBuild to use this connection, in the <code>source</code> object, set the <code>auth</code> object's <code>type</code> value to <code>OAUTH</code>.</p> </li> </ul> <p> If you specify <code>CODEPIPELINE</code> for the <code>Type</code> property, don't specify this property. For all of the other types, you must specify <code>Location</code>. </p>",
         "ProjectSource$buildspec": "<p>The buildspec file declaration to use for the builds in this build project.</p> <p> If this value is set, it can be either an inline buildspec definition, the path to an alternate buildspec file relative to the value of the built-in <code>CODEBUILD_SRC_DIR</code> environment variable, or the path to an S3 bucket. The bucket must be in the same Amazon Web Services Region as the build project. Specify the buildspec file using its ARN (for example, <code>arn:aws:s3:::my-codebuild-sample2/buildspec.yml</code>). If this value is not provided or is set to an empty string, the source code must contain a buildspec file in its root directory. For more information, see <a href=\"https://docs.aws.amazon.com/codebuild/latest/userguide/build-spec-ref.html#build-spec-ref-name-storage\">Buildspec File Name and Storage Location</a>. </p>",
         "ProjectSource$sourceIdentifier": "<p>An identifier for this project source. The identifier can only contain alphanumeric characters and underscores, and must be less than 128 characters in length. </p>",
         "ProjectSourceVersion$sourceIdentifier": "<p>An identifier for a source in the build project. The identifier can only contain alphanumeric characters and underscores, and must be less than 128 characters in length. </p>",
@@ -2036,7 +2036,7 @@
     "WebhookFilterType": {
       "base": null,
       "refs": {
-        "WebhookFilter$type": "<p> The type of webhook filter. There are eight webhook filter types: <code>EVENT</code>, <code>ACTOR_ACCOUNT_ID</code>, <code>HEAD_REF</code>, <code>BASE_REF</code>, <code>FILE_PATH</code>, <code>COMMIT_MESSAGE</code>, <code>TAG_NAME</code>, and <code>RELEASE_NAME</code>. </p> <ul> <li> <p> EVENT </p> <ul> <li> <p> A webhook event triggers a build when the provided <code>pattern</code> matches one of eight event types: <code>PUSH</code>, <code>PULL_REQUEST_CREATED</code>, <code>PULL_REQUEST_UPDATED</code>, <code>PULL_REQUEST_CLOSED</code>, <code>PULL_REQUEST_REOPENED</code>, <code>PULL_REQUEST_MERGED</code>, <code>RELEASED</code>, and <code>PRERELEASED</code>. The <code>EVENT</code> patterns are specified as a comma-separated string. For example, <code>PUSH, PULL_REQUEST_CREATED, PULL_REQUEST_UPDATED</code> filters all push, pull request created, and pull request updated events. </p> <note> <p> The <code>PULL_REQUEST_REOPENED</code> works with GitHub and GitHub Enterprise only. The <code>RELEASED</code> and <code>PRERELEASED</code> work with GitHub only.</p> </note> </li> </ul> </li> <li> <p>ACTOR_ACCOUNT_ID</p> <ul> <li> <p> A webhook event triggers a build when a GitHub, GitHub Enterprise, or Bitbucket account ID matches the regular expression <code>pattern</code>. </p> </li> </ul> </li> <li> <p>HEAD_REF</p> <ul> <li> <p> A webhook event triggers a build when the head reference matches the regular expression <code>pattern</code>. For example, <code>refs/heads/branch-name</code> and <code>refs/tags/tag-name</code>. </p> <note> <p> Works with GitHub and GitHub Enterprise push, GitHub and GitHub Enterprise pull request, Bitbucket push, and Bitbucket pull request events.</p> </note> </li> </ul> </li> <li> <p>BASE_REF</p> <ul> <li> <p> A webhook event triggers a build when the base reference matches the regular expression <code>pattern</code>. For example, <code>refs/heads/branch-name</code>. </p> <note> <p> Works with pull request events only. </p> </note> </li> </ul> </li> <li> <p>FILE_PATH</p> <ul> <li> <p> A webhook triggers a build when the path of a changed file matches the regular expression <code>pattern</code>. </p> <note> <p> Works with GitHub and Bitbucket events push and pull requests events. Also works with GitHub Enterprise push events, but does not work with GitHub Enterprise pull request events. </p> </note> </li> </ul> </li> <li> <p>COMMIT_MESSAGE</p> <ul> <li> <p>A webhook triggers a build when the head commit message matches the regular expression <code>pattern</code>.</p> <note> <p> Works with GitHub and Bitbucket events push and pull requests events. Also works with GitHub Enterprise push events, but does not work with GitHub Enterprise pull request events. </p> </note> </li> </ul> </li> <li> <p>TAG_NAME</p> <ul> <li> <p>A webhook triggers a build when the tag name of the release matches the regular expression <code>pattern</code>.</p> <note> <p> Works with <code>RELEASED</code> and <code>PRERELEASED</code> events only. </p> </note> </li> </ul> </li> <li> <p>RELEASE_NAME</p> <ul> <li> <p>A webhook triggers a build when the release name matches the regular expression <code>pattern</code>.</p> <note> <p> Works with <code>RELEASED</code> and <code>PRERELEASED</code> events only. </p> </note> </li> </ul> </li> </ul>"
+        "WebhookFilter$type": "<p> The type of webhook filter. There are nine webhook filter types: <code>EVENT</code>, <code>ACTOR_ACCOUNT_ID</code>, <code>HEAD_REF</code>, <code>BASE_REF</code>, <code>FILE_PATH</code>, <code>COMMIT_MESSAGE</code>, <code>TAG_NAME</code>, <code>RELEASE_NAME</code>, and <code>WORKFLOW_NAME</code>. </p> <ul> <li> <p> EVENT </p> <ul> <li> <p> A webhook event triggers a build when the provided <code>pattern</code> matches one of nine event types: <code>PUSH</code>, <code>PULL_REQUEST_CREATED</code>, <code>PULL_REQUEST_UPDATED</code>, <code>PULL_REQUEST_CLOSED</code>, <code>PULL_REQUEST_REOPENED</code>, <code>PULL_REQUEST_MERGED</code>, <code>RELEASED</code>, <code>PRERELEASED</code>, and <code>WORKFLOW_JOB_QUEUED</code>. The <code>EVENT</code> patterns are specified as a comma-separated string. For example, <code>PUSH, PULL_REQUEST_CREATED, PULL_REQUEST_UPDATED</code> filters all push, pull request created, and pull request updated events. </p> <note> <p> The <code>PULL_REQUEST_REOPENED</code> works with GitHub and GitHub Enterprise only. The <code>RELEASED</code>, <code>PRERELEASED</code>, and <code>WORKFLOW_JOB_QUEUED</code> work with GitHub only.</p> </note> </li> </ul> </li> <li> <p>ACTOR_ACCOUNT_ID</p> <ul> <li> <p> A webhook event triggers a build when a GitHub, GitHub Enterprise, or Bitbucket account ID matches the regular expression <code>pattern</code>. </p> </li> </ul> </li> <li> <p>HEAD_REF</p> <ul> <li> <p> A webhook event triggers a build when the head reference matches the regular expression <code>pattern</code>. For example, <code>refs/heads/branch-name</code> and <code>refs/tags/tag-name</code>. </p> <note> <p> Works with GitHub and GitHub Enterprise push, GitHub and GitHub Enterprise pull request, Bitbucket push, and Bitbucket pull request events.</p> </note> </li> </ul> </li> <li> <p>BASE_REF</p> <ul> <li> <p> A webhook event triggers a build when the base reference matches the regular expression <code>pattern</code>. For example, <code>refs/heads/branch-name</code>. </p> <note> <p> Works with pull request events only. </p> </note> </li> </ul> </li> <li> <p>FILE_PATH</p> <ul> <li> <p> A webhook triggers a build when the path of a changed file matches the regular expression <code>pattern</code>. </p> <note> <p> Works with GitHub and Bitbucket events push and pull requests events. Also works with GitHub Enterprise push events, but does not work with GitHub Enterprise pull request events. </p> </note> </li> </ul> </li> <li> <p>COMMIT_MESSAGE</p> <ul> <li> <p>A webhook triggers a build when the head commit message matches the regular expression <code>pattern</code>.</p> <note> <p> Works with GitHub and Bitbucket events push and pull requests events. Also works with GitHub Enterprise push events, but does not work with GitHub Enterprise pull request events. </p> </note> </li> </ul> </li> <li> <p>TAG_NAME</p> <ul> <li> <p>A webhook triggers a build when the tag name of the release matches the regular expression <code>pattern</code>.</p> <note> <p> Works with <code>RELEASED</code> and <code>PRERELEASED</code> events only. </p> </note> </li> </ul> </li> <li> <p>RELEASE_NAME</p> <ul> <li> <p>A webhook triggers a build when the release name matches the regular expression <code>pattern</code>.</p> <note> <p> Works with <code>RELEASED</code> and <code>PRERELEASED</code> events only. </p> </note> </li> </ul> </li> <li> <p>WORKFLOW_NAME</p> <ul> <li> <p>A webhook triggers a build when the workflow name matches the regular expression <code>pattern</code>.</p> <note> <p> Works with <code>WORKFLOW_JOB_QUEUED</code> events only. </p> </note> </li> </ul> </li> </ul>"
       }
     },
     "WrapperBoolean": {
diff --git a/models/apis/mediaconvert/2017-08-29/api-2.json b/models/apis/mediaconvert/2017-08-29/api-2.json
index 617f0eab0f1..68d465e125d 100644
--- a/models/apis/mediaconvert/2017-08-29/api-2.json
+++ b/models/apis/mediaconvert/2017-08-29/api-2.json
@@ -2066,6 +2066,22 @@
           "shape": "BurninSubtitleFontColor",
           "locationName": "fontColor"
         },
+        "FontFileBold": {
+          "shape": "__stringPatternS3TtfHttpsTtf",
+          "locationName": "fontFileBold"
+        },
+        "FontFileBoldItalic": {
+          "shape": "__string",
+          "locationName": "fontFileBoldItalic"
+        },
+        "FontFileItalic": {
+          "shape": "__stringPatternS3TtfHttpsTtf",
+          "locationName": "fontFileItalic"
+        },
+        "FontFileRegular": {
+          "shape": "__stringPatternS3TtfHttpsTtf",
+          "locationName": "fontFileRegular"
+        },
         "FontOpacity": {
           "shape": "__integerMin0Max255",
           "locationName": "fontOpacity"
@@ -3880,6 +3896,22 @@
           "shape": "DvbSubtitleFontColor",
           "locationName": "fontColor"
         },
+        "FontFileBold": {
+          "shape": "__stringPatternS3TtfHttpsTtf",
+          "locationName": "fontFileBold"
+        },
+        "FontFileBoldItalic": {
+          "shape": "__stringPatternS3TtfHttpsTtf",
+          "locationName": "fontFileBoldItalic"
+        },
+        "FontFileItalic": {
+          "shape": "__stringPatternS3TtfHttpsTtf",
+          "locationName": "fontFileItalic"
+        },
+        "FontFileRegular": {
+          "shape": "__stringPatternS3TtfHttpsTtf",
+          "locationName": "fontFileRegular"
+        },
         "FontOpacity": {
           "shape": "__integerMin0Max255",
           "locationName": "fontOpacity"
@@ -7454,6 +7486,13 @@
         "CONFIGURED_PCR_PERIOD"
       ]
     },
+    "M2tsPreventBufferUnderflow": {
+      "type": "string",
+      "enum": [
+        "DISABLED",
+        "ENABLED"
+      ]
+    },
     "M2tsRateMode": {
       "type": "string",
       "enum": [
@@ -7606,6 +7645,10 @@
           "shape": "__integerMin32Max8182",
           "locationName": "pmtPid"
         },
+        "PreventBufferUnderflow": {
+          "shape": "M2tsPreventBufferUnderflow",
+          "locationName": "preventBufferUnderflow"
+        },
         "PrivateMetadataPid": {
           "shape": "__integerMin32Max8182",
           "locationName": "privateMetadataPid"
@@ -12189,6 +12232,10 @@
       "type": "string",
       "pattern": "^s3://([^\\/]+\\/+)+((([^\\/]*)))|^https?://[^\\/].*[^&]$"
     },
+    "__stringPatternS3TtfHttpsTtf": {
+      "type": "string",
+      "pattern": "^((s3://(.*?)\\.(ttf))|(https?://(.*?)\\.(ttf)(\\?([^&=]+=[^&]+&)*[^&=]+=[^&]+)?))$"
+    },
     "__stringPatternSNManifestConfirmConditionNotificationNS": {
       "type": "string",
       "pattern": "^\\s*<(.|\\n)*ManifestConfirmConditionNotification(.|\\n)*>\\s*$"
diff --git a/models/apis/mediaconvert/2017-08-29/docs-2.json b/models/apis/mediaconvert/2017-08-29/docs-2.json
index 993d770f66c..307aa7bb7ad 100644
--- a/models/apis/mediaconvert/2017-08-29/docs-2.json
+++ b/models/apis/mediaconvert/2017-08-29/docs-2.json
@@ -508,9 +508,9 @@
       }
     },
     "BurnInSubtitleStylePassthrough": {
-      "base": "Set Style passthrough to ENABLED to use the available style, color, and position information from your input captions. MediaConvert uses default settings for any missing style and position information in your input captions. Set Style passthrough to DISABLED, or leave blank, to ignore the style and position information from your input captions and use default settings: white text with black outlining, bottom-center positioning, and automatic sizing. Whether you set Style passthrough to enabled or not, you can also choose to manually override any of the individual style and position settings.",
+      "base": "To use the available style, color, and position information from your input captions: Set Style passthrough to Enabled. Note that MediaConvert uses default settings for any missing style or position information in your input captions To ignore the style and position information from your input captions and use default settings: Leave blank or keep the default value, Disabled. Default settings include white text with black outlining, bottom-center positioning, and automatic sizing. Whether you set Style passthrough to enabled or not, you can also choose to manually override any of the individual style and position settings. You can also override any fonts by manually specifying custom font files.",
       "refs": {
-        "BurninDestinationSettings$StylePassthrough": "Set Style passthrough to ENABLED to use the available style, color, and position information from your input captions. MediaConvert uses default settings for any missing style and position information in your input captions. Set Style passthrough to DISABLED, or leave blank, to ignore the style and position information from your input captions and use default settings: white text with black outlining, bottom-center positioning, and automatic sizing. Whether you set Style passthrough to enabled or not, you can also choose to manually override any of the individual style and position settings."
+        "BurninDestinationSettings$StylePassthrough": "To use the available style, color, and position information from your input captions: Set Style passthrough to Enabled. Note that MediaConvert uses default settings for any missing style or position information in your input captions To ignore the style and position information from your input captions and use default settings: Leave blank or keep the default value, Disabled. Default settings include white text with black outlining, bottom-center positioning, and automatic sizing. Whether you set Style passthrough to enabled or not, you can also choose to manually override any of the individual style and position settings. You can also override any fonts by manually specifying custom font files."
       }
     },
     "BurninDestinationSettings": {
@@ -1276,9 +1276,9 @@
       }
     },
     "DvbSubtitleStylePassthrough": {
-      "base": "Set Style passthrough to ENABLED to use the available style, color, and position information from your input captions. MediaConvert uses default settings for any missing style and position information in your input captions. Set Style passthrough to DISABLED, or leave blank, to ignore the style and position information from your input captions and use default settings: white text with black outlining, bottom-center positioning, and automatic sizing. Whether you set Style passthrough to enabled or not, you can also choose to manually override any of the individual style and position settings.",
+      "base": "To use the available style, color, and position information from your input captions: Set Style passthrough to Enabled. Note that MediaConvert uses default settings for any missing style or position information in your input captions To ignore the style and position information from your input captions and use default settings: Leave blank or keep the default value, Disabled. Default settings include white text with black outlining, bottom-center positioning, and automatic sizing. Whether you set Style passthrough to enabled or not, you can also choose to manually override any of the individual style and position settings. You can also override any fonts by manually specifying custom font files.",
       "refs": {
-        "DvbSubDestinationSettings$StylePassthrough": "Set Style passthrough to ENABLED to use the available style, color, and position information from your input captions. MediaConvert uses default settings for any missing style and position information in your input captions. Set Style passthrough to DISABLED, or leave blank, to ignore the style and position information from your input captions and use default settings: white text with black outlining, bottom-center positioning, and automatic sizing. Whether you set Style passthrough to enabled or not, you can also choose to manually override any of the individual style and position settings."
+        "DvbSubDestinationSettings$StylePassthrough": "To use the available style, color, and position information from your input captions: Set Style passthrough to Enabled. Note that MediaConvert uses default settings for any missing style or position information in your input captions To ignore the style and position information from your input captions and use default settings: Leave blank or keep the default value, Disabled. Default settings include white text with black outlining, bottom-center positioning, and automatic sizing. Whether you set Style passthrough to enabled or not, you can also choose to manually override any of the individual style and position settings. You can also override any fonts by manually specifying custom font files."
       }
     },
     "DvbSubtitleTeletextSpacing": {
@@ -2532,6 +2532,12 @@
         "M2tsSettings$PcrControl": "When set to PCR_EVERY_PES_PACKET, a Program Clock Reference value is inserted for every Packetized Elementary Stream (PES) header. This is effective only when the PCR PID is the same as the video or audio elementary stream."
       }
     },
+    "M2tsPreventBufferUnderflow": {
+      "base": "Specify whether MediaConvert automatically attempts to prevent decoder buffer underflows in your transport stream output. Use if you are seeing decoder buffer underflows in your output and are unable to increase your transport stream's bitrate. For most workflows: We recommend that you keep the default value, Disabled. To prevent decoder buffer underflows in your output, when possible: Choose Enabled. Note that if MediaConvert prevents a decoder buffer underflow in your output, output video quality is reduced and your job will take longer to complete.",
+      "refs": {
+        "M2tsSettings$PreventBufferUnderflow": "Specify whether MediaConvert automatically attempts to prevent decoder buffer underflows in your transport stream output. Use if you are seeing decoder buffer underflows in your output and are unable to increase your transport stream's bitrate. For most workflows: We recommend that you keep the default value, Disabled. To prevent decoder buffer underflows in your output, when possible: Choose Enabled. Note that if MediaConvert prevents a decoder buffer underflow in your output, output video quality is reduced and your job will take longer to complete."
+      }
+    },
     "M2tsRateMode": {
       "base": "When set to CBR, inserts null packets into transport stream to fill specified bitrate. When set to VBR, the bitrate setting acts as the maximum bitrate, but the output will not be padded up to that bitrate.",
       "refs": {
@@ -5015,8 +5021,8 @@
     "__listOfColorConversion3DLUTSetting": {
       "base": null,
       "refs": {
-        "JobSettings$ColorConversion3DLUTSettings": "Use 3D LUTs to specify custom color mapping behavior when you convert from one color space into another. You can include up to 8 different 3D LUTs.",
-        "JobTemplateSettings$ColorConversion3DLUTSettings": "Use 3D LUTs to specify custom color mapping behavior when you convert from one color space into another. You can include up to 8 different 3D LUTs."
+        "JobSettings$ColorConversion3DLUTSettings": "Use 3D LUTs to specify custom color mapping behavior when you convert from one color space into another. You can include up to 8 different 3D LUTs. For more information, see: https://docs.aws.amazon.com/mediaconvert/latest/ug/3d-luts.html",
+        "JobTemplateSettings$ColorConversion3DLUTSettings": "Use 3D LUTs to specify custom color mapping behavior when you convert from one color space into another. You can include up to 8 different 3D LUTs. For more information, see: https://docs.aws.amazon.com/mediaconvert/latest/ug/3d-luts.html"
       }
     },
     "__listOfDashAdditionalManifest": {
@@ -5291,6 +5297,7 @@
       "refs": {
         "AssociateCertificateRequest$Arn": "The ARN of the ACM certificate that you want to associate with your MediaConvert resource.",
         "AudioDescription$AudioSourceName": "Specifies which audio data to use from each input. In the simplest case, specify an \"Audio Selector\":#inputs-audio_selector by name based on its order within each input. For example if you specify \"Audio Selector 3\", then the third audio selector will be used from each input. If an input does not have an \"Audio Selector 3\", then the audio selector marked as \"default\" in that input will be used. If there is no audio selector marked as \"default\", silence will be inserted for the duration of that input. Alternatively, an \"Audio Selector Group\":#inputs-audio_selector_group name may be specified, with similar default/silence behavior. If no audio_source_name is specified, then \"Audio Selector 1\" will be chosen automatically.",
+        "BurninDestinationSettings$FontFileBoldItalic": "Specify a bold italic TrueType font file to use when rendering your output captions.\nEnter an S3, HTTP, or HTTPS URL.\nWhen you do, you must also separately specify a regular, a bold, and an italic font file.",
         "CancelJobRequest$Id": "The Job ID of the job to be cancelled.",
         "CaptionDescription$LanguageDescription": "Specify a label for this set of output captions. For example, \"English\", \"Director commentary\", or \"track_2\". For streaming outputs, MediaConvert passes this information into destination manifests for display on the end-viewer's player device. For outputs in other output groups, the service ignores this setting.",
         "CaptionDescriptionPreset$LanguageDescription": "Specify a label for this set of output captions. For example, \"English\", \"Director commentary\", or \"track_2\". For streaming outputs, MediaConvert passes this information into destination manifests for display on the end-viewer's player device. For outputs in other output groups, the service ignores this setting.",
@@ -5703,6 +5710,18 @@
         "VideoOverlayInput$FileInput": "Specify the input file S3, HTTP, or HTTPS URI for your video overlay. For consistency in color and formatting in your output video image, we recommend that you specify a video with similar characteristics as the underlying input video."
       }
     },
+    "__stringPatternS3TtfHttpsTtf": {
+      "base": null,
+      "refs": {
+        "BurninDestinationSettings$FontFileBold": "Specify a bold TrueType font file to use when rendering your output captions. Enter an S3, HTTP, or HTTPS URL. When you do, you must also separately specify a regular, an italic, and a bold italic font file.",
+        "BurninDestinationSettings$FontFileItalic": "Specify an italic TrueType font file to use when rendering your output captions. Enter an S3, HTTP, or HTTPS URL. When you do, you must also separately specify a regular, a bold, and a bold italic font file.",
+        "BurninDestinationSettings$FontFileRegular": "Specify a regular TrueType font file to use when rendering your output captions. Enter an S3, HTTP, or HTTPS URL. When you do, you must also separately specify a bold, an italic, and a bold italic font file.",
+        "DvbSubDestinationSettings$FontFileBold": "Specify a bold TrueType font file to use when rendering your output captions. Enter an S3, HTTP, or HTTPS URL. When you do, you must also separately specify a regular, an italic, and a bold italic font file.",
+        "DvbSubDestinationSettings$FontFileBoldItalic": "Specify a bold italic TrueType font file to use when rendering your output captions.\nEnter an S3, HTTP, or HTTPS URL.\nWhen you do, you must also separately specify a regular, a bold, and an italic font file.",
+        "DvbSubDestinationSettings$FontFileItalic": "Specify an italic TrueType font file to use when rendering your output captions. Enter an S3, HTTP, or HTTPS URL. When you do, you must also separately specify a regular, a bold, and a bold italic font file.",
+        "DvbSubDestinationSettings$FontFileRegular": "Specify a regular TrueType font file to use when rendering your output captions. Enter an S3, HTTP, or HTTPS URL. When you do, you must also separately specify a bold, an italic, and a bold italic font file."
+      }
+    },
     "__stringPatternSNManifestConfirmConditionNotificationNS": {
       "base": null,
       "refs": {
diff --git a/models/apis/pinpoint/2016-12-01/api-2.json b/models/apis/pinpoint/2016-12-01/api-2.json
index 69013ebeee2..31ac3806fdf 100644
--- a/models/apis/pinpoint/2016-12-01/api-2.json
+++ b/models/apis/pinpoint/2016-12-01/api-2.json
@@ -7000,6 +7000,9 @@
         },
         "RoleArn": {
           "shape": "__string"
+        },
+        "OrchestrationSendingRoleArn": {
+          "shape": "__string"
         }
       },
       "required": [
@@ -7052,6 +7055,9 @@
         "RoleArn": {
           "shape": "__string"
         },
+        "OrchestrationSendingRoleArn": {
+          "shape": "__string"
+        },
         "Version": {
           "shape": "__integer"
         }
diff --git a/models/apis/pinpoint/2016-12-01/docs-2.json b/models/apis/pinpoint/2016-12-01/docs-2.json
index d92dcf7f24a..357edb5234b 100644
--- a/models/apis/pinpoint/2016-12-01/docs-2.json
+++ b/models/apis/pinpoint/2016-12-01/docs-2.json
@@ -487,8 +487,8 @@
     "DeliveryStatus": {
       "base": null,
       "refs": {
-        "EndpointMessageResult$DeliveryStatus": "<p>The delivery status of the message. Possible values are:</p> <ul> <li><p>DUPLICATE - The endpoint address is a duplicate of another endpoint address. Amazon Pinpoint won't attempt to send the message again.</p></li> <li><p>OPT_OUT - The user who's associated with the endpoint has opted out of receiving messages from you. Amazon Pinpoint won't attempt to send the message again.</p></li> <li><p>PERMANENT_FAILURE - An error occurred when delivering the message to the endpoint. Amazon Pinpoint won't attempt to send the message again.</p></li>    <li><p>SUCCESSFUL - The message was successfully delivered to the endpoint.</p></li> <li><p>TEMPORARY_FAILURE - A temporary error occurred. Amazon Pinpoint won't attempt to send the message again.</p></li> <li><p>THROTTLED - Amazon Pinpoint throttled the operation to send the message to the endpoint.</p></li> <li><p>TIMEOUT - The message couldn't be sent within the timeout period.</p></li> <li><p>UNKNOWN_FAILURE - An unknown error occurred.</p></li></ul>",
-        "MessageResult$DeliveryStatus": "<p>The delivery status of the message. Possible values are:</p> <ul> <li><p>DUPLICATE - The endpoint address is a duplicate of another endpoint address. Amazon Pinpoint won't attempt to send the message again.</p></li>   <li><p>OPT_OUT - The user who's associated with the endpoint address has opted out of receiving messages from you. Amazon Pinpoint won't attempt to send the message again.</p></li> <li><p>PERMANENT_FAILURE - An error occurred when delivering the message to the endpoint address. Amazon Pinpoint won't attempt to send the message again.</p></li>   <li><p>SUCCESSFUL - The message was successfully delivered to the endpoint address.</p></li> <li><p>TEMPORARY_FAILURE - A temporary error occurred. Amazon Pinpoint won't attempt to send the message again.</p></li> <li><p>THROTTLED - Amazon Pinpoint throttled the operation to send the message to the endpoint address.</p></li> <li><p>TIMEOUT - The message couldn't be sent within the timeout period.</p></li> <li><p>UNKNOWN_FAILURE - An unknown error occurred.</p></li></ul>"
+        "EndpointMessageResult$DeliveryStatus": "<p>The delivery status of the message. Possible values are:</p> <ul> <li><p>DUPLICATE - The endpoint address is a duplicate of another endpoint address. Amazon Pinpoint won't attempt to send the message again.</p></li> <li><p>OPT_OUT - The user who's associated with the endpoint has opted out of receiving messages from you. Amazon Pinpoint won't attempt to send the message again.</p></li> <li><p>PERMANENT_FAILURE - An error occurred when delivering the message to the endpoint. Amazon Pinpoint won't attempt to send the message again.</p></li>    <li><p>SUCCESSFUL - The message was successfully delivered to the endpoint.</p></li> <li><p>TEMPORARY_FAILURE - A temporary error occurred. Amazon Pinpoint won't attempt to send the message again.</p></li> <li><p>THROTTLED - Amazon Pinpoint throttled the operation to send the message to the endpoint.</p></li> <li><p>UNKNOWN_FAILURE - An unknown error occurred.</p></li></ul>",
+        "MessageResult$DeliveryStatus": "<p>The delivery status of the message. Possible values are:</p> <ul> <li><p>DUPLICATE - The endpoint address is a duplicate of another endpoint address. Amazon Pinpoint won't attempt to send the message again.</p></li>   <li><p>OPT_OUT - The user who's associated with the endpoint address has opted out of receiving messages from you. Amazon Pinpoint won't attempt to send the message again.</p></li> <li><p>PERMANENT_FAILURE - An error occurred when delivering the message to the endpoint address. Amazon Pinpoint won't attempt to send the message again.</p></li>   <li><p>SUCCESSFUL - The message was successfully delivered to the endpoint address.</p></li> <li><p>TEMPORARY_FAILURE - A temporary error occurred. Amazon Pinpoint won't attempt to send the message again.</p></li> <li><p>THROTTLED - Amazon Pinpoint throttled the operation to send the message to the endpoint address.</p></li> <li><p>UNKNOWN_FAILURE - An unknown error occurred.</p></li></ul>"
       }
     },
     "DimensionType": {
@@ -2233,6 +2233,7 @@
         "EmailChannelRequest$FromAddress": " <p>The verified email address that you want to send email from when you send email through the channel.</p>",
         "EmailChannelRequest$Identity": " <p>The Amazon Resource Name (ARN) of the identity, verified with Amazon Simple Email Service (Amazon SES), that you want to use when you send email through the channel.</p>",
         "EmailChannelRequest$RoleArn": " <p>The ARN of the AWS Identity and Access Management (IAM) role that you want Amazon Pinpoint to use when it submits email-related event data for the channel.</p>",
+        "EmailChannelRequest$OrchestrationSendingRoleArn": "<p>The ARN of an IAM role for Amazon Pinpoint to use to send email from your campaigns or journeys through Amazon SES.</p>",
         "EmailChannelResponse$ApplicationId": "<p>The unique identifier for the application that the email channel applies to.</p>",
         "EmailChannelResponse$ConfigurationSet": "<p>The <a href=\"https://docs.aws.amazon.com/ses/latest/APIReference/API_ConfigurationSet.html\">Amazon SES configuration set</a> that's applied to messages that are sent through the channel.</p>",
         "EmailChannelResponse$CreationDate": "<p>The date and time, in ISO 8601 format, when the email channel was enabled.</p>",
@@ -2243,6 +2244,7 @@
         "EmailChannelResponse$LastModifiedDate": "<p>The date and time, in ISO 8601 format, when the email channel was last modified.</p>",
         "EmailChannelResponse$Platform": "<p>The type of messaging or notification platform for the channel. For the email channel, this value is EMAIL.</p>",
         "EmailChannelResponse$RoleArn": " <p>The ARN of the AWS Identity and Access Management (IAM) role that Amazon Pinpoint uses to submit email-related event data for the channel.</p>",
+        "EmailChannelResponse$OrchestrationSendingRoleArn": "<p>The ARN of an IAM role for Amazon Pinpoint to use to send email from your campaigns or journeys through Amazon SES.</p>",
         "EmailMessage$Body": "<p>The body of the email message.</p>",
         "EmailMessage$FeedbackForwardingAddress": "<p>The email address to forward bounces and complaints to, if feedback forwarding is enabled.</p>",
         "EmailMessage$FromAddress": "<p>The verified email address to send the email message from. The default value is the FromAddress specified for the email channel.</p>",
diff --git a/models/apis/rds/2014-10-31/api-2.json b/models/apis/rds/2014-10-31/api-2.json
index 8a59d210bbe..12e55fd0d77 100644
--- a/models/apis/rds/2014-10-31/api-2.json
+++ b/models/apis/rds/2014-10-31/api-2.json
@@ -437,7 +437,8 @@
         {"shape":"KMSKeyNotAccessibleFault"},
         {"shape":"DomainNotFoundFault"},
         {"shape":"NetworkTypeNotSupported"},
-        {"shape":"TenantDatabaseQuotaExceededFault"}
+        {"shape":"TenantDatabaseQuotaExceededFault"},
+        {"shape":"CertificateNotFoundFault"}
       ]
     },
     "CreateDBParameterGroup":{
@@ -2551,6 +2552,7 @@
         {"shape":"BackupPolicyNotFoundFault"},
         {"shape":"NetworkTypeNotSupported"},
         {"shape":"DBClusterSnapshotNotFoundFault"},
+        {"shape":"CertificateNotFoundFault"},
         {"shape":"TenantDatabaseQuotaExceededFault"}
       ]
     },
@@ -2583,7 +2585,8 @@
         {"shape":"AuthorizationNotFoundFault"},
         {"shape":"KMSKeyNotAccessibleFault"},
         {"shape":"BackupPolicyNotFoundFault"},
-        {"shape":"NetworkTypeNotSupported"}
+        {"shape":"NetworkTypeNotSupported"},
+        {"shape":"CertificateNotFoundFault"}
       ]
     },
     "RestoreDBInstanceToPointInTime":{
@@ -2621,7 +2624,8 @@
         {"shape":"DBParameterGroupNotFoundFault"},
         {"shape":"DBInstanceAutomatedBackupNotFoundFault"},
         {"shape":"NetworkTypeNotSupported"},
-        {"shape":"TenantDatabaseQuotaExceededFault"}
+        {"shape":"TenantDatabaseQuotaExceededFault"},
+        {"shape":"CertificateNotFoundFault"}
       ]
     },
     "RevokeDBSecurityGroupIngress":{
@@ -3752,7 +3756,8 @@
         "AllocatedStorage":{"shape":"IntegerOptional"},
         "SourceDBClusterIdentifier":{"shape":"String"},
         "DedicatedLogVolume":{"shape":"BooleanOptional"},
-        "UpgradeStorageConfig":{"shape":"BooleanOptional"}
+        "UpgradeStorageConfig":{"shape":"BooleanOptional"},
+        "CACertificateIdentifier":{"shape":"String"}
       }
     },
     "CreateDBInstanceReadReplicaResult":{
@@ -9248,7 +9253,8 @@
         "StorageThroughput":{"shape":"IntegerOptional"},
         "DBClusterSnapshotIdentifier":{"shape":"String"},
         "AllocatedStorage":{"shape":"IntegerOptional"},
-        "DedicatedLogVolume":{"shape":"BooleanOptional"}
+        "DedicatedLogVolume":{"shape":"BooleanOptional"},
+        "CACertificateIdentifier":{"shape":"String"}
       }
     },
     "RestoreDBInstanceFromDBSnapshotResult":{
@@ -9317,7 +9323,8 @@
         "StorageThroughput":{"shape":"IntegerOptional"},
         "ManageMasterUserPassword":{"shape":"BooleanOptional"},
         "MasterUserSecretKmsKeyId":{"shape":"String"},
-        "DedicatedLogVolume":{"shape":"BooleanOptional"}
+        "DedicatedLogVolume":{"shape":"BooleanOptional"},
+        "CACertificateIdentifier":{"shape":"String"}
       }
     },
     "RestoreDBInstanceFromS3Result":{
@@ -9373,7 +9380,8 @@
         "NetworkType":{"shape":"String"},
         "StorageThroughput":{"shape":"IntegerOptional"},
         "AllocatedStorage":{"shape":"IntegerOptional"},
-        "DedicatedLogVolume":{"shape":"BooleanOptional"}
+        "DedicatedLogVolume":{"shape":"BooleanOptional"},
+        "CACertificateIdentifier":{"shape":"String"}
       }
     },
     "RestoreDBInstanceToPointInTimeResult":{
diff --git a/models/apis/rds/2014-10-31/docs-2.json b/models/apis/rds/2014-10-31/docs-2.json
index eac61c5e91c..d68818191e4 100644
--- a/models/apis/rds/2014-10-31/docs-2.json
+++ b/models/apis/rds/2014-10-31/docs-2.json
@@ -4690,7 +4690,7 @@
         "CreateDBClusterMessage$ReplicationSourceIdentifier": "<p>The Amazon Resource Name (ARN) of the source DB instance or DB cluster if this DB cluster is created as a read replica.</p> <p>Valid for Cluster Type: Aurora DB clusters and Multi-AZ DB clusters</p>",
         "CreateDBClusterMessage$KmsKeyId": "<p>The Amazon Web Services KMS key identifier for an encrypted DB cluster.</p> <p>The Amazon Web Services KMS key identifier is the key ARN, key ID, alias ARN, or alias name for the KMS key. To use a KMS key in a different Amazon Web Services account, specify the key ARN or alias ARN.</p> <p>When a KMS key isn't specified in <code>KmsKeyId</code>:</p> <ul> <li> <p>If <code>ReplicationSourceIdentifier</code> identifies an encrypted source, then Amazon RDS uses the KMS key used to encrypt the source. Otherwise, Amazon RDS uses your default KMS key.</p> </li> <li> <p>If the <code>StorageEncrypted</code> parameter is enabled and <code>ReplicationSourceIdentifier</code> isn't specified, then Amazon RDS uses your default KMS key.</p> </li> </ul> <p>There is a default KMS key for your Amazon Web Services account. Your Amazon Web Services account has a different default KMS key for each Amazon Web Services Region.</p> <p>If you create a read replica of an encrypted DB cluster in another Amazon Web Services Region, make sure to set <code>KmsKeyId</code> to a KMS key identifier that is valid in the destination Amazon Web Services Region. This KMS key is used to encrypt the read replica in that Amazon Web Services Region.</p> <p>Valid for Cluster Type: Aurora DB clusters and Multi-AZ DB clusters</p>",
         "CreateDBClusterMessage$PreSignedUrl": "<p>When you are replicating a DB cluster from one Amazon Web Services GovCloud (US) Region to another, an URL that contains a Signature Version 4 signed request for the <code>CreateDBCluster</code> operation to be called in the source Amazon Web Services Region where the DB cluster is replicated from. Specify <code>PreSignedUrl</code> only when you are performing cross-Region replication from an encrypted DB cluster.</p> <p>The presigned URL must be a valid request for the <code>CreateDBCluster</code> API operation that can run in the source Amazon Web Services Region that contains the encrypted DB cluster to copy.</p> <p>The presigned URL request must contain the following parameter values:</p> <ul> <li> <p> <code>KmsKeyId</code> - The KMS key identifier for the KMS key to use to encrypt the copy of the DB cluster in the destination Amazon Web Services Region. This should refer to the same KMS key for both the <code>CreateDBCluster</code> operation that is called in the destination Amazon Web Services Region, and the operation contained in the presigned URL.</p> </li> <li> <p> <code>DestinationRegion</code> - The name of the Amazon Web Services Region that Aurora read replica will be created in.</p> </li> <li> <p> <code>ReplicationSourceIdentifier</code> - The DB cluster identifier for the encrypted DB cluster to be copied. This identifier must be in the Amazon Resource Name (ARN) format for the source Amazon Web Services Region. For example, if you are copying an encrypted DB cluster from the us-west-2 Amazon Web Services Region, then your <code>ReplicationSourceIdentifier</code> would look like Example: <code>arn:aws:rds:us-west-2:123456789012:cluster:aurora-cluster1</code>.</p> </li> </ul> <p>To learn how to generate a Signature Version 4 signed request, see <a href=\"https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-query-string-auth.html\"> Authenticating Requests: Using Query Parameters (Amazon Web Services Signature Version 4)</a> and <a href=\"https://docs.aws.amazon.com/general/latest/gr/signature-version-4.html\"> Signature Version 4 Signing Process</a>.</p> <note> <p>If you are using an Amazon Web Services SDK tool or the CLI, you can specify <code>SourceRegion</code> (or <code>--source-region</code> for the CLI) instead of specifying <code>PreSignedUrl</code> manually. Specifying <code>SourceRegion</code> autogenerates a presigned URL that is a valid request for the operation that can run in the source Amazon Web Services Region.</p> </note> <p>Valid for Cluster Type: Aurora DB clusters only</p>",
-        "CreateDBClusterMessage$EngineMode": "<p>The DB engine mode of the DB cluster, either <code>provisioned</code> or <code>serverless</code>.</p> <p>The <code>serverless</code> engine mode only applies for Aurora Serverless v1 DB clusters.</p> <p>For information about limitations and requirements for Serverless DB clusters, see the following sections in the <i>Amazon Aurora User Guide</i>:</p> <ul> <li> <p> <a href=\"https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-serverless.html#aurora-serverless.limitations\">Limitations of Aurora Serverless v1</a> </p> </li> <li> <p> <a href=\"https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-serverless-v2.requirements.html\">Requirements for Aurora Serverless v2</a> </p> </li> </ul> <p>Valid for Cluster Type: Aurora DB clusters only</p>",
+        "CreateDBClusterMessage$EngineMode": "<p>The DB engine mode of the DB cluster, either <code>provisioned</code> or <code>serverless</code>.</p> <p>The <code>serverless</code> engine mode only applies for Aurora Serverless v1 DB clusters. Aurora Serverless v2 DB clusters use the <code>provisioned</code> engine mode.</p> <p>For information about limitations and requirements for Serverless DB clusters, see the following sections in the <i>Amazon Aurora User Guide</i>:</p> <ul> <li> <p> <a href=\"https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-serverless.html#aurora-serverless.limitations\">Limitations of Aurora Serverless v1</a> </p> </li> <li> <p> <a href=\"https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora-serverless-v2.requirements.html\">Requirements for Aurora Serverless v2</a> </p> </li> </ul> <p>Valid for Cluster Type: Aurora DB clusters only</p>",
         "CreateDBClusterMessage$GlobalClusterIdentifier": "<p>The global cluster ID of an Aurora cluster that becomes the primary cluster in the new global database cluster.</p> <p>Valid for Cluster Type: Aurora DB clusters only</p>",
         "CreateDBClusterMessage$Domain": "<p>The Active Directory directory ID to create the DB cluster in.</p> <p>For Amazon Aurora DB clusters, Amazon RDS can use Kerberos authentication to authenticate users that connect to the DB cluster.</p> <p>For more information, see <a href=\"https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/kerberos-authentication.html\">Kerberos authentication</a> in the <i>Amazon Aurora User Guide</i>.</p> <p>Valid for Cluster Type: Aurora DB clusters only</p>",
         "CreateDBClusterMessage$DomainIAMRoleName": "<p>The name of the IAM role to use when making API calls to the Directory Service.</p> <p>Valid for Cluster Type: Aurora DB clusters only</p>",
@@ -4762,6 +4762,7 @@
         "CreateDBInstanceReadReplicaMessage$CustomIamInstanceProfile": "<p>The instance profile associated with the underlying Amazon EC2 instance of an RDS Custom DB instance. The instance profile must meet the following requirements:</p> <ul> <li> <p>The profile must exist in your account.</p> </li> <li> <p>The profile must have an IAM role that Amazon EC2 has permissions to assume.</p> </li> <li> <p>The instance profile name and the associated IAM role name must start with the prefix <code>AWSRDSCustom</code>.</p> </li> </ul> <p>For the list of permissions required for the IAM role, see <a href=\"https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/custom-setup-orcl.html#custom-setup-orcl.iam-vpc\"> Configure IAM and your VPC</a> in the <i>Amazon RDS User Guide</i>.</p> <p>This setting is required for RDS Custom DB instances.</p>",
         "CreateDBInstanceReadReplicaMessage$NetworkType": "<p>The network type of the DB instance.</p> <p>Valid Values:</p> <ul> <li> <p> <code>IPV4</code> </p> </li> <li> <p> <code>DUAL</code> </p> </li> </ul> <p>The network type is determined by the <code>DBSubnetGroup</code> specified for read replica. A <code>DBSubnetGroup</code> can support only the IPv4 protocol or the IPv4 and the IPv6 protocols (<code>DUAL</code>).</p> <p>For more information, see <a href=\"https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_VPC.WorkingWithRDSInstanceinaVPC.html\"> Working with a DB instance in a VPC</a> in the <i>Amazon RDS User Guide.</i> </p>",
         "CreateDBInstanceReadReplicaMessage$SourceDBClusterIdentifier": "<p>The identifier of the Multi-AZ DB cluster that will act as the source for the read replica. Each DB cluster can have up to 15 read replicas.</p> <p>Constraints:</p> <ul> <li> <p>Must be the identifier of an existing Multi-AZ DB cluster.</p> </li> <li> <p>Can't be specified if the <code>SourceDBInstanceIdentifier</code> parameter is also specified.</p> </li> <li> <p>The specified DB cluster must have automatic backups enabled, that is, its backup retention period must be greater than 0.</p> </li> <li> <p>The source DB cluster must be in the same Amazon Web Services Region as the read replica. Cross-Region replication isn't supported.</p> </li> </ul>",
+        "CreateDBInstanceReadReplicaMessage$CACertificateIdentifier": "<p>The CA certificate identifier to use for the read replica's server certificate.</p> <p>This setting doesn't apply to RDS Custom DB instances.</p> <p>For more information, see <a href=\"https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html\">Using SSL/TLS to encrypt a connection to a DB instance</a> in the <i>Amazon RDS User Guide</i> and <a href=\"https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/UsingWithRDS.SSL.html\"> Using SSL/TLS to encrypt a connection to a DB cluster</a> in the <i>Amazon Aurora User Guide</i>.</p>",
         "CreateDBParameterGroupMessage$DBParameterGroupName": "<p>The name of the DB parameter group.</p> <p>Constraints:</p> <ul> <li> <p>Must be 1 to 255 letters, numbers, or hyphens.</p> </li> <li> <p>First character must be a letter</p> </li> <li> <p>Can't end with a hyphen or contain two consecutive hyphens</p> </li> </ul> <note> <p>This value is stored as a lowercase string.</p> </note>",
         "CreateDBParameterGroupMessage$DBParameterGroupFamily": "<p>The DB parameter group family name. A DB parameter group can be associated with one and only one DB parameter group family, and can be applied only to a DB instance running a database engine and engine version compatible with that DB parameter group family.</p> <p>To list all of the available parameter group families for a DB engine, use the following command:</p> <p> <code>aws rds describe-db-engine-versions --query \"DBEngineVersions[].DBParameterGroupFamily\" --engine &lt;engine&gt;</code> </p> <p>For example, to list all of the available parameter group families for the MySQL DB engine, use the following command:</p> <p> <code>aws rds describe-db-engine-versions --query \"DBEngineVersions[].DBParameterGroupFamily\" --engine mysql</code> </p> <note> <p>The output contains duplicates.</p> </note> <p>The following are the valid DB engine values:</p> <ul> <li> <p> <code>aurora-mysql</code> </p> </li> <li> <p> <code>aurora-postgresql</code> </p> </li> <li> <p> <code>db2-ae</code> </p> </li> <li> <p> <code>db2-se</code> </p> </li> <li> <p> <code>mysql</code> </p> </li> <li> <p> <code>oracle-ee</code> </p> </li> <li> <p> <code>oracle-ee-cdb</code> </p> </li> <li> <p> <code>oracle-se2</code> </p> </li> <li> <p> <code>oracle-se2-cdb</code> </p> </li> <li> <p> <code>postgres</code> </p> </li> <li> <p> <code>sqlserver-ee</code> </p> </li> <li> <p> <code>sqlserver-se</code> </p> </li> <li> <p> <code>sqlserver-ex</code> </p> </li> <li> <p> <code>sqlserver-web</code> </p> </li> </ul>",
         "CreateDBParameterGroupMessage$Description": "<p>The description for the DB parameter group.</p>",
@@ -5585,6 +5586,7 @@
         "RestoreDBInstanceFromDBSnapshotMessage$BackupTarget": "<p>Specifies where automated backups and manual snapshots are stored for the restored DB instance.</p> <p>Possible values are <code>outposts</code> (Amazon Web Services Outposts) and <code>region</code> (Amazon Web Services Region). The default is <code>region</code>.</p> <p>For more information, see <a href=\"https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-on-outposts.html\">Working with Amazon RDS on Amazon Web Services Outposts</a> in the <i>Amazon RDS User Guide</i>.</p>",
         "RestoreDBInstanceFromDBSnapshotMessage$NetworkType": "<p>The network type of the DB instance.</p> <p>Valid Values:</p> <ul> <li> <p> <code>IPV4</code> </p> </li> <li> <p> <code>DUAL</code> </p> </li> </ul> <p>The network type is determined by the <code>DBSubnetGroup</code> specified for the DB instance. A <code>DBSubnetGroup</code> can support only the IPv4 protocol or the IPv4 and the IPv6 protocols (<code>DUAL</code>).</p> <p>For more information, see <a href=\"https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_VPC.WorkingWithRDSInstanceinaVPC.html\"> Working with a DB instance in a VPC</a> in the <i>Amazon RDS User Guide.</i> </p>",
         "RestoreDBInstanceFromDBSnapshotMessage$DBClusterSnapshotIdentifier": "<p>The identifier for the Multi-AZ DB cluster snapshot to restore from.</p> <p>For more information on Multi-AZ DB clusters, see <a href=\"https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/multi-az-db-clusters-concepts.html\"> Multi-AZ DB cluster deployments</a> in the <i>Amazon RDS User Guide</i>.</p> <p>Constraints:</p> <ul> <li> <p>Must match the identifier of an existing Multi-AZ DB cluster snapshot.</p> </li> <li> <p>Can't be specified when <code>DBSnapshotIdentifier</code> is specified.</p> </li> <li> <p>Must be specified when <code>DBSnapshotIdentifier</code> isn't specified.</p> </li> <li> <p>If you are restoring from a shared manual Multi-AZ DB cluster snapshot, the <code>DBClusterSnapshotIdentifier</code> must be the ARN of the shared snapshot.</p> </li> <li> <p>Can't be the identifier of an Aurora DB cluster snapshot.</p> </li> </ul>",
+        "RestoreDBInstanceFromDBSnapshotMessage$CACertificateIdentifier": "<p>The CA certificate identifier to use for the DB instance's server certificate.</p> <p>This setting doesn't apply to RDS Custom DB instances.</p> <p>For more information, see <a href=\"https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html\">Using SSL/TLS to encrypt a connection to a DB instance</a> in the <i>Amazon RDS User Guide</i> and <a href=\"https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/UsingWithRDS.SSL.html\"> Using SSL/TLS to encrypt a connection to a DB cluster</a> in the <i>Amazon Aurora User Guide</i>.</p>",
         "RestoreDBInstanceFromS3Message$DBName": "<p>The name of the database to create when the DB instance is created. Follow the naming rules specified in <code>CreateDBInstance</code>.</p>",
         "RestoreDBInstanceFromS3Message$DBInstanceIdentifier": "<p>The DB instance identifier. This parameter is stored as a lowercase string.</p> <p>Constraints:</p> <ul> <li> <p>Must contain from 1 to 63 letters, numbers, or hyphens.</p> </li> <li> <p>First character must be a letter.</p> </li> <li> <p>Can't end with a hyphen or contain two consecutive hyphens.</p> </li> </ul> <p>Example: <code>mydbinstance</code> </p>",
         "RestoreDBInstanceFromS3Message$DBInstanceClass": "<p>The compute and memory capacity of the DB instance, for example db.m4.large. Not all DB instance classes are available in all Amazon Web Services Regions, or for all database engines. For the full list of DB instance classes, and availability for your engine, see <a href=\"https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.DBInstanceClass.html\">DB Instance Class</a> in the <i>Amazon RDS User Guide.</i> </p> <p>Importing from Amazon S3 isn't supported on the db.t2.micro DB instance class.</p>",
@@ -5610,6 +5612,7 @@
         "RestoreDBInstanceFromS3Message$PerformanceInsightsKMSKeyId": "<p>The Amazon Web Services KMS key identifier for encryption of Performance Insights data.</p> <p>The Amazon Web Services KMS key identifier is the key ARN, key ID, alias ARN, or alias name for the KMS key.</p> <p>If you do not specify a value for <code>PerformanceInsightsKMSKeyId</code>, then Amazon RDS uses your default KMS key. There is a default KMS key for your Amazon Web Services account. Your Amazon Web Services account has a different default KMS key for each Amazon Web Services Region.</p>",
         "RestoreDBInstanceFromS3Message$NetworkType": "<p>The network type of the DB instance.</p> <p>Valid Values:</p> <ul> <li> <p> <code>IPV4</code> </p> </li> <li> <p> <code>DUAL</code> </p> </li> </ul> <p>The network type is determined by the <code>DBSubnetGroup</code> specified for the DB instance. A <code>DBSubnetGroup</code> can support only the IPv4 protocol or the IPv4 and the IPv6 protocols (<code>DUAL</code>).</p> <p>For more information, see <a href=\"https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_VPC.WorkingWithRDSInstanceinaVPC.html\"> Working with a DB instance in a VPC</a> in the <i>Amazon RDS User Guide.</i> </p>",
         "RestoreDBInstanceFromS3Message$MasterUserSecretKmsKeyId": "<p>The Amazon Web Services KMS key identifier to encrypt a secret that is automatically generated and managed in Amazon Web Services Secrets Manager.</p> <p>This setting is valid only if the master user password is managed by RDS in Amazon Web Services Secrets Manager for the DB instance.</p> <p>The Amazon Web Services KMS key identifier is the key ARN, key ID, alias ARN, or alias name for the KMS key. To use a KMS key in a different Amazon Web Services account, specify the key ARN or alias ARN.</p> <p>If you don't specify <code>MasterUserSecretKmsKeyId</code>, then the <code>aws/secretsmanager</code> KMS key is used to encrypt the secret. If the secret is in a different Amazon Web Services account, then you can't use the <code>aws/secretsmanager</code> KMS key to encrypt the secret, and you must use a customer managed KMS key.</p> <p>There is a default KMS key for your Amazon Web Services account. Your Amazon Web Services account has a different default KMS key for each Amazon Web Services Region.</p>",
+        "RestoreDBInstanceFromS3Message$CACertificateIdentifier": "<p>The CA certificate identifier to use for the DB instance's server certificate.</p> <p>This setting doesn't apply to RDS Custom DB instances.</p> <p>For more information, see <a href=\"https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html\">Using SSL/TLS to encrypt a connection to a DB instance</a> in the <i>Amazon RDS User Guide</i> and <a href=\"https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/UsingWithRDS.SSL.html\"> Using SSL/TLS to encrypt a connection to a DB cluster</a> in the <i>Amazon Aurora User Guide</i>.</p>",
         "RestoreDBInstanceToPointInTimeMessage$SourceDBInstanceIdentifier": "<p>The identifier of the source DB instance from which to restore.</p> <p>Constraints:</p> <ul> <li> <p>Must match the identifier of an existing DB instance.</p> </li> </ul>",
         "RestoreDBInstanceToPointInTimeMessage$TargetDBInstanceIdentifier": "<p>The name of the new DB instance to create.</p> <p>Constraints:</p> <ul> <li> <p>Must contain from 1 to 63 letters, numbers, or hyphens.</p> </li> <li> <p>First character must be a letter.</p> </li> <li> <p>Can't end with a hyphen or contain two consecutive hyphens.</p> </li> </ul>",
         "RestoreDBInstanceToPointInTimeMessage$DBInstanceClass": "<p>The compute and memory capacity of the Amazon RDS DB instance, for example db.m4.large. Not all DB instance classes are available in all Amazon Web Services Regions, or for all database engines. For the full list of DB instance classes, and availability for your engine, see <a href=\"https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.DBInstanceClass.html\">DB Instance Class</a> in the <i>Amazon RDS User Guide</i>.</p> <p>Default: The same DB instance class as the original DB instance.</p>",
@@ -5633,6 +5636,7 @@
         "RestoreDBInstanceToPointInTimeMessage$CustomIamInstanceProfile": "<p>The instance profile associated with the underlying Amazon EC2 instance of an RDS Custom DB instance. The instance profile must meet the following requirements:</p> <ul> <li> <p>The profile must exist in your account.</p> </li> <li> <p>The profile must have an IAM role that Amazon EC2 has permissions to assume.</p> </li> <li> <p>The instance profile name and the associated IAM role name must start with the prefix <code>AWSRDSCustom</code>.</p> </li> </ul> <p>For the list of permissions required for the IAM role, see <a href=\"https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/custom-setup-orcl.html#custom-setup-orcl.iam-vpc\"> Configure IAM and your VPC</a> in the <i>Amazon RDS User Guide</i>.</p> <p>This setting is required for RDS Custom.</p>",
         "RestoreDBInstanceToPointInTimeMessage$BackupTarget": "<p>The location for storing automated backups and manual snapshots for the restored DB instance.</p> <p>Valid Values:</p> <ul> <li> <p> <code>outposts</code> (Amazon Web Services Outposts)</p> </li> <li> <p> <code>region</code> (Amazon Web Services Region)</p> </li> </ul> <p>Default: <code>region</code> </p> <p>For more information, see <a href=\"https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-on-outposts.html\">Working with Amazon RDS on Amazon Web Services Outposts</a> in the <i>Amazon RDS User Guide</i>.</p>",
         "RestoreDBInstanceToPointInTimeMessage$NetworkType": "<p>The network type of the DB instance.</p> <p>The network type is determined by the <code>DBSubnetGroup</code> specified for the DB instance. A <code>DBSubnetGroup</code> can support only the IPv4 protocol or the IPv4 and the IPv6 protocols (<code>DUAL</code>).</p> <p>For more information, see <a href=\"https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_VPC.WorkingWithRDSInstanceinaVPC.html\"> Working with a DB instance in a VPC</a> in the <i>Amazon RDS User Guide.</i> </p> <p>Valid Values:</p> <ul> <li> <p> <code>IPV4</code> </p> </li> <li> <p> <code>DUAL</code> </p> </li> </ul>",
+        "RestoreDBInstanceToPointInTimeMessage$CACertificateIdentifier": "<p>The CA certificate identifier to use for the DB instance's server certificate.</p> <p>This setting doesn't apply to RDS Custom DB instances.</p> <p>For more information, see <a href=\"https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html\">Using SSL/TLS to encrypt a connection to a DB instance</a> in the <i>Amazon RDS User Guide</i> and <a href=\"https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/UsingWithRDS.SSL.html\"> Using SSL/TLS to encrypt a connection to a DB cluster</a> in the <i>Amazon Aurora User Guide</i>.</p>",
         "RevokeDBSecurityGroupIngressMessage$DBSecurityGroupName": "<p>The name of the DB security group to revoke ingress from.</p>",
         "RevokeDBSecurityGroupIngressMessage$CIDRIP": "<p>The IP range to revoke access from. Must be a valid CIDR range. If <code>CIDRIP</code> is specified, <code>EC2SecurityGroupName</code>, <code>EC2SecurityGroupId</code> and <code>EC2SecurityGroupOwnerId</code> can't be provided.</p>",
         "RevokeDBSecurityGroupIngressMessage$EC2SecurityGroupName": "<p>The name of the EC2 security group to revoke access from. For VPC DB security groups, <code>EC2SecurityGroupId</code> must be provided. Otherwise, EC2SecurityGroupOwnerId and either <code>EC2SecurityGroupName</code> or <code>EC2SecurityGroupId</code> must be provided.</p>",
diff --git a/models/endpoints/endpoints.json b/models/endpoints/endpoints.json
index ea0d3186733..549dad4a1ce 100644
--- a/models/endpoints/endpoints.json
+++ b/models/endpoints/endpoints.json
@@ -14750,19 +14750,29 @@
       },
       "resource-explorer-2" : {
         "endpoints" : {
+          "af-south-1" : { },
+          "ap-east-1" : { },
           "ap-northeast-1" : { },
           "ap-northeast-2" : { },
           "ap-northeast-3" : { },
           "ap-south-1" : { },
+          "ap-south-2" : { },
           "ap-southeast-1" : { },
           "ap-southeast-2" : { },
           "ap-southeast-3" : { },
+          "ap-southeast-4" : { },
           "ca-central-1" : { },
+          "ca-west-1" : { },
           "eu-central-1" : { },
+          "eu-central-2" : { },
           "eu-north-1" : { },
+          "eu-south-1" : { },
+          "eu-south-2" : { },
           "eu-west-1" : { },
           "eu-west-2" : { },
           "eu-west-3" : { },
+          "il-central-1" : { },
+          "me-central-1" : { },
           "me-south-1" : { },
           "sa-east-1" : { },
           "us-east-1" : { },
diff --git a/service/codebuild/api.go b/service/codebuild/api.go
index abae6c326cd..b8248a1e2d3 100644
--- a/service/codebuild/api.go
+++ b/service/codebuild/api.go
@@ -13457,12 +13457,11 @@ type ProjectSource struct {
 	//    account. Use the CodeBuild console to start creating a build project.
 	//    When you use the console to connect (or reconnect) with GitLab, on the
 	//    Connections Authorize application page, choose Authorize. Then on the
-	//    CodeStar Connections Create GitLab connection page, choose Connect to
-	//    GitLab. (After you have connected to your GitLab account, you do not need
-	//    to finish creating the build project. You can leave the CodeBuild console.)
-	//    To instruct CodeBuild to override the default connection and use this
-	//    connection instead, set the auth object's type value to CODECONNECTIONS
-	//    in the source object.
+	//    CodeConnections Create GitLab connection page, choose Connect to GitLab.
+	//    (After you have connected to your GitLab account, you do not need to finish
+	//    creating the build project. You can leave the CodeBuild console.) To instruct
+	//    CodeBuild to override the default connection and use this connection instead,
+	//    set the auth object's type value to CODECONNECTIONS in the source object.
 	//
 	//    * For source code in a Bitbucket repository, the HTTPS clone URL to the
 	//    repository that contains the source and the buildspec file. You must connect
@@ -17935,18 +17934,19 @@ type WebhookFilter struct {
 	// Pattern is a required field
 	Pattern *string `locationName:"pattern" type:"string" required:"true"`
 
-	// The type of webhook filter. There are eight webhook filter types: EVENT,
-	// ACTOR_ACCOUNT_ID, HEAD_REF, BASE_REF, FILE_PATH, COMMIT_MESSAGE, TAG_NAME,
-	// and RELEASE_NAME.
+	// The type of webhook filter. There are nine webhook filter types: EVENT, ACTOR_ACCOUNT_ID,
+	// HEAD_REF, BASE_REF, FILE_PATH, COMMIT_MESSAGE, TAG_NAME, RELEASE_NAME, and
+	// WORKFLOW_NAME.
 	//
 	//    * EVENT A webhook event triggers a build when the provided pattern matches
-	//    one of eight event types: PUSH, PULL_REQUEST_CREATED, PULL_REQUEST_UPDATED,
+	//    one of nine event types: PUSH, PULL_REQUEST_CREATED, PULL_REQUEST_UPDATED,
 	//    PULL_REQUEST_CLOSED, PULL_REQUEST_REOPENED, PULL_REQUEST_MERGED, RELEASED,
-	//    and PRERELEASED. The EVENT patterns are specified as a comma-separated
-	//    string. For example, PUSH, PULL_REQUEST_CREATED, PULL_REQUEST_UPDATED
-	//    filters all push, pull request created, and pull request updated events.
-	//    The PULL_REQUEST_REOPENED works with GitHub and GitHub Enterprise only.
-	//    The RELEASED and PRERELEASED work with GitHub only.
+	//    PRERELEASED, and WORKFLOW_JOB_QUEUED. The EVENT patterns are specified
+	//    as a comma-separated string. For example, PUSH, PULL_REQUEST_CREATED,
+	//    PULL_REQUEST_UPDATED filters all push, pull request created, and pull
+	//    request updated events. The PULL_REQUEST_REOPENED works with GitHub and
+	//    GitHub Enterprise only. The RELEASED, PRERELEASED, and WORKFLOW_JOB_QUEUED
+	//    work with GitHub only.
 	//
 	//    * ACTOR_ACCOUNT_ID A webhook event triggers a build when a GitHub, GitHub
 	//    Enterprise, or Bitbucket account ID matches the regular expression pattern.
@@ -17979,6 +17979,10 @@ type WebhookFilter struct {
 	//    the regular expression pattern. Works with RELEASED and PRERELEASED events
 	//    only.
 	//
+	//    * WORKFLOW_NAME A webhook triggers a build when the workflow name matches
+	//    the regular expression pattern. Works with WORKFLOW_JOB_QUEUED events
+	//    only.
+	//
 	// Type is a required field
 	Type *string `locationName:"type" type:"string" required:"true" enum:"WebhookFilterType"`
 }
@@ -19060,6 +19064,15 @@ const (
 
 	// WebhookFilterTypeCommitMessage is a WebhookFilterType enum value
 	WebhookFilterTypeCommitMessage = "COMMIT_MESSAGE"
+
+	// WebhookFilterTypeWorkflowName is a WebhookFilterType enum value
+	WebhookFilterTypeWorkflowName = "WORKFLOW_NAME"
+
+	// WebhookFilterTypeTagName is a WebhookFilterType enum value
+	WebhookFilterTypeTagName = "TAG_NAME"
+
+	// WebhookFilterTypeReleaseName is a WebhookFilterType enum value
+	WebhookFilterTypeReleaseName = "RELEASE_NAME"
 )
 
 // WebhookFilterType_Values returns all elements of the WebhookFilterType enum
@@ -19071,5 +19084,8 @@ func WebhookFilterType_Values() []string {
 		WebhookFilterTypeActorAccountId,
 		WebhookFilterTypeFilePath,
 		WebhookFilterTypeCommitMessage,
+		WebhookFilterTypeWorkflowName,
+		WebhookFilterTypeTagName,
+		WebhookFilterTypeReleaseName,
 	}
 }
diff --git a/service/mediaconvert/api.go b/service/mediaconvert/api.go
index 816e81856d5..496fe1958fa 100644
--- a/service/mediaconvert/api.go
+++ b/service/mediaconvert/api.go
@@ -5385,6 +5385,26 @@ type BurninDestinationSettings struct {
 	// input captions, if present.
 	FontColor *string `locationName:"fontColor" type:"string" enum:"BurninSubtitleFontColor"`
 
+	// Specify a bold TrueType font file to use when rendering your output captions.
+	// Enter an S3, HTTP, or HTTPS URL. When you do, you must also separately specify
+	// a regular, an italic, and a bold italic font file.
+	FontFileBold *string `locationName:"fontFileBold" type:"string"`
+
+	// Specify a bold italic TrueType font file to use when rendering your output
+	// captions.Enter an S3, HTTP, or HTTPS URL.When you do, you must also separately
+	// specify a regular, a bold, and an italic font file.
+	FontFileBoldItalic *string `locationName:"fontFileBoldItalic" type:"string"`
+
+	// Specify an italic TrueType font file to use when rendering your output captions.
+	// Enter an S3, HTTP, or HTTPS URL. When you do, you must also separately specify
+	// a regular, a bold, and a bold italic font file.
+	FontFileItalic *string `locationName:"fontFileItalic" type:"string"`
+
+	// Specify a regular TrueType font file to use when rendering your output captions.
+	// Enter an S3, HTTP, or HTTPS URL. When you do, you must also separately specify
+	// a bold, an italic, and a bold italic font file.
+	FontFileRegular *string `locationName:"fontFileRegular" type:"string"`
+
 	// Specify the opacity of the burned-in captions. 255 is opaque; 0 is transparent.
 	FontOpacity *int64 `locationName:"fontOpacity" type:"integer"`
 
@@ -5440,14 +5460,16 @@ type BurninDestinationSettings struct {
 	// y-offset data from your input captions, if present.
 	ShadowYOffset *int64 `locationName:"shadowYOffset" type:"integer"`
 
-	// Set Style passthrough to ENABLED to use the available style, color, and position
-	// information from your input captions. MediaConvert uses default settings
-	// for any missing style and position information in your input captions. Set
-	// Style passthrough to DISABLED, or leave blank, to ignore the style and position
-	// information from your input captions and use default settings: white text
-	// with black outlining, bottom-center positioning, and automatic sizing. Whether
-	// you set Style passthrough to enabled or not, you can also choose to manually
-	// override any of the individual style and position settings.
+	// To use the available style, color, and position information from your input
+	// captions: Set Style passthrough to Enabled. Note that MediaConvert uses default
+	// settings for any missing style or position information in your input captions
+	// To ignore the style and position information from your input captions and
+	// use default settings: Leave blank or keep the default value, Disabled. Default
+	// settings include white text with black outlining, bottom-center positioning,
+	// and automatic sizing. Whether you set Style passthrough to enabled or not,
+	// you can also choose to manually override any of the individual style and
+	// position settings. You can also override any fonts by manually specifying
+	// custom font files.
 	StylePassthrough *string `locationName:"stylePassthrough" type:"string" enum:"BurnInSubtitleStylePassthrough"`
 
 	// Specify whether the text spacing in your captions is set by the captions
@@ -5545,6 +5567,30 @@ func (s *BurninDestinationSettings) SetFontColor(v string) *BurninDestinationSet
 	return s
 }
 
+// SetFontFileBold sets the FontFileBold field's value.
+func (s *BurninDestinationSettings) SetFontFileBold(v string) *BurninDestinationSettings {
+	s.FontFileBold = &v
+	return s
+}
+
+// SetFontFileBoldItalic sets the FontFileBoldItalic field's value.
+func (s *BurninDestinationSettings) SetFontFileBoldItalic(v string) *BurninDestinationSettings {
+	s.FontFileBoldItalic = &v
+	return s
+}
+
+// SetFontFileItalic sets the FontFileItalic field's value.
+func (s *BurninDestinationSettings) SetFontFileItalic(v string) *BurninDestinationSettings {
+	s.FontFileItalic = &v
+	return s
+}
+
+// SetFontFileRegular sets the FontFileRegular field's value.
+func (s *BurninDestinationSettings) SetFontFileRegular(v string) *BurninDestinationSettings {
+	s.FontFileRegular = &v
+	return s
+}
+
 // SetFontOpacity sets the FontOpacity field's value.
 func (s *BurninDestinationSettings) SetFontOpacity(v int64) *BurninDestinationSettings {
 	s.FontOpacity = &v
@@ -10112,6 +10158,26 @@ type DvbSubDestinationSettings struct {
 	// identical.
 	FontColor *string `locationName:"fontColor" type:"string" enum:"DvbSubtitleFontColor"`
 
+	// Specify a bold TrueType font file to use when rendering your output captions.
+	// Enter an S3, HTTP, or HTTPS URL. When you do, you must also separately specify
+	// a regular, an italic, and a bold italic font file.
+	FontFileBold *string `locationName:"fontFileBold" type:"string"`
+
+	// Specify a bold italic TrueType font file to use when rendering your output
+	// captions.Enter an S3, HTTP, or HTTPS URL.When you do, you must also separately
+	// specify a regular, a bold, and an italic font file.
+	FontFileBoldItalic *string `locationName:"fontFileBoldItalic" type:"string"`
+
+	// Specify an italic TrueType font file to use when rendering your output captions.
+	// Enter an S3, HTTP, or HTTPS URL. When you do, you must also separately specify
+	// a regular, a bold, and a bold italic font file.
+	FontFileItalic *string `locationName:"fontFileItalic" type:"string"`
+
+	// Specify a regular TrueType font file to use when rendering your output captions.
+	// Enter an S3, HTTP, or HTTPS URL. When you do, you must also separately specify
+	// a bold, an italic, and a bold italic font file.
+	FontFileRegular *string `locationName:"fontFileRegular" type:"string"`
+
 	// Specify the opacity of the burned-in captions. 255 is opaque; 0 is transparent.Within
 	// your job settings, all of your DVB-Sub settings must be identical.
 	FontOpacity *int64 `locationName:"fontOpacity" type:"integer"`
@@ -10182,14 +10248,16 @@ type DvbSubDestinationSettings struct {
 	// all of your DVB-Sub settings must be identical.
 	ShadowYOffset *int64 `locationName:"shadowYOffset" type:"integer"`
 
-	// Set Style passthrough to ENABLED to use the available style, color, and position
-	// information from your input captions. MediaConvert uses default settings
-	// for any missing style and position information in your input captions. Set
-	// Style passthrough to DISABLED, or leave blank, to ignore the style and position
-	// information from your input captions and use default settings: white text
-	// with black outlining, bottom-center positioning, and automatic sizing. Whether
-	// you set Style passthrough to enabled or not, you can also choose to manually
-	// override any of the individual style and position settings.
+	// To use the available style, color, and position information from your input
+	// captions: Set Style passthrough to Enabled. Note that MediaConvert uses default
+	// settings for any missing style or position information in your input captions
+	// To ignore the style and position information from your input captions and
+	// use default settings: Leave blank or keep the default value, Disabled. Default
+	// settings include white text with black outlining, bottom-center positioning,
+	// and automatic sizing. Whether you set Style passthrough to enabled or not,
+	// you can also choose to manually override any of the individual style and
+	// position settings. You can also override any fonts by manually specifying
+	// custom font files.
 	StylePassthrough *string `locationName:"stylePassthrough" type:"string" enum:"DvbSubtitleStylePassthrough"`
 
 	// Specify whether your DVB subtitles are standard or for hearing impaired.
@@ -10325,6 +10393,30 @@ func (s *DvbSubDestinationSettings) SetFontColor(v string) *DvbSubDestinationSet
 	return s
 }
 
+// SetFontFileBold sets the FontFileBold field's value.
+func (s *DvbSubDestinationSettings) SetFontFileBold(v string) *DvbSubDestinationSettings {
+	s.FontFileBold = &v
+	return s
+}
+
+// SetFontFileBoldItalic sets the FontFileBoldItalic field's value.
+func (s *DvbSubDestinationSettings) SetFontFileBoldItalic(v string) *DvbSubDestinationSettings {
+	s.FontFileBoldItalic = &v
+	return s
+}
+
+// SetFontFileItalic sets the FontFileItalic field's value.
+func (s *DvbSubDestinationSettings) SetFontFileItalic(v string) *DvbSubDestinationSettings {
+	s.FontFileItalic = &v
+	return s
+}
+
+// SetFontFileRegular sets the FontFileRegular field's value.
+func (s *DvbSubDestinationSettings) SetFontFileRegular(v string) *DvbSubDestinationSettings {
+	s.FontFileRegular = &v
+	return s
+}
+
 // SetFontOpacity sets the FontOpacity field's value.
 func (s *DvbSubDestinationSettings) SetFontOpacity(v int64) *DvbSubDestinationSettings {
 	s.FontOpacity = &v
@@ -16825,6 +16917,7 @@ type JobSettings struct {
 
 	// Use 3D LUTs to specify custom color mapping behavior when you convert from
 	// one color space into another. You can include up to 8 different 3D LUTs.
+	// For more information, see: https://docs.aws.amazon.com/mediaconvert/latest/ug/3d-luts.html
 	ColorConversion3DLUTSettings []*ColorConversion3DLUTSetting `locationName:"colorConversion3DLUTSettings" type:"list"`
 
 	// Settings for Event Signaling And Messaging (ESAM). If you don't do ad insertion,
@@ -17235,6 +17328,7 @@ type JobTemplateSettings struct {
 
 	// Use 3D LUTs to specify custom color mapping behavior when you convert from
 	// one color space into another. You can include up to 8 different 3D LUTs.
+	// For more information, see: https://docs.aws.amazon.com/mediaconvert/latest/ug/3d-luts.html
 	ColorConversion3DLUTSettings []*ColorConversion3DLUTSetting `locationName:"colorConversion3DLUTSettings" type:"list"`
 
 	// Settings for Event Signaling And Messaging (ESAM). If you don't do ad insertion,
@@ -18475,6 +18569,16 @@ type M2tsSettings struct {
 	// Default is 480.
 	PmtPid *int64 `locationName:"pmtPid" min:"32" type:"integer"`
 
+	// Specify whether MediaConvert automatically attempts to prevent decoder buffer
+	// underflows in your transport stream output. Use if you are seeing decoder
+	// buffer underflows in your output and are unable to increase your transport
+	// stream's bitrate. For most workflows: We recommend that you keep the default
+	// value, Disabled. To prevent decoder buffer underflows in your output, when
+	// possible: Choose Enabled. Note that if MediaConvert prevents a decoder buffer
+	// underflow in your output, output video quality is reduced and your job will
+	// take longer to complete.
+	PreventBufferUnderflow *string `locationName:"preventBufferUnderflow" type:"string" enum:"M2tsPreventBufferUnderflow"`
+
 	// Specify the packet identifier (PID) of the private metadata stream. Default
 	// is 503.
 	PrivateMetadataPid *int64 `locationName:"privateMetadataPid" min:"32" type:"integer"`
@@ -18791,6 +18895,12 @@ func (s *M2tsSettings) SetPmtPid(v int64) *M2tsSettings {
 	return s
 }
 
+// SetPreventBufferUnderflow sets the PreventBufferUnderflow field's value.
+func (s *M2tsSettings) SetPreventBufferUnderflow(v string) *M2tsSettings {
+	s.PreventBufferUnderflow = &v
+	return s
+}
+
 // SetPrivateMetadataPid sets the PrivateMetadataPid field's value.
 func (s *M2tsSettings) SetPrivateMetadataPid(v int64) *M2tsSettings {
 	s.PrivateMetadataPid = &v
@@ -29223,14 +29333,16 @@ func BillingTagsSource_Values() []string {
 	}
 }
 
-// Set Style passthrough to ENABLED to use the available style, color, and position
-// information from your input captions. MediaConvert uses default settings
-// for any missing style and position information in your input captions. Set
-// Style passthrough to DISABLED, or leave blank, to ignore the style and position
-// information from your input captions and use default settings: white text
-// with black outlining, bottom-center positioning, and automatic sizing. Whether
-// you set Style passthrough to enabled or not, you can also choose to manually
-// override any of the individual style and position settings.
+// To use the available style, color, and position information from your input
+// captions: Set Style passthrough to Enabled. Note that MediaConvert uses default
+// settings for any missing style or position information in your input captions
+// To ignore the style and position information from your input captions and
+// use default settings: Leave blank or keep the default value, Disabled. Default
+// settings include white text with black outlining, bottom-center positioning,
+// and automatic sizing. Whether you set Style passthrough to enabled or not,
+// you can also choose to manually override any of the individual style and
+// position settings. You can also override any fonts by manually specifying
+// custom font files.
 const (
 	// BurnInSubtitleStylePassthroughEnabled is a BurnInSubtitleStylePassthrough enum value
 	BurnInSubtitleStylePassthroughEnabled = "ENABLED"
@@ -31261,14 +31373,16 @@ func DvbSubtitleShadowColor_Values() []string {
 	}
 }
 
-// Set Style passthrough to ENABLED to use the available style, color, and position
-// information from your input captions. MediaConvert uses default settings
-// for any missing style and position information in your input captions. Set
-// Style passthrough to DISABLED, or leave blank, to ignore the style and position
-// information from your input captions and use default settings: white text
-// with black outlining, bottom-center positioning, and automatic sizing. Whether
-// you set Style passthrough to enabled or not, you can also choose to manually
-// override any of the individual style and position settings.
+// To use the available style, color, and position information from your input
+// captions: Set Style passthrough to Enabled. Note that MediaConvert uses default
+// settings for any missing style or position information in your input captions
+// To ignore the style and position information from your input captions and
+// use default settings: Leave blank or keep the default value, Disabled. Default
+// settings include white text with black outlining, bottom-center positioning,
+// and automatic sizing. Whether you set Style passthrough to enabled or not,
+// you can also choose to manually override any of the individual style and
+// position settings. You can also override any fonts by manually specifying
+// custom font files.
 const (
 	// DvbSubtitleStylePassthroughEnabled is a DvbSubtitleStylePassthrough enum value
 	DvbSubtitleStylePassthroughEnabled = "ENABLED"
@@ -35437,6 +35551,30 @@ func M2tsPcrControl_Values() []string {
 	}
 }
 
+// Specify whether MediaConvert automatically attempts to prevent decoder buffer
+// underflows in your transport stream output. Use if you are seeing decoder
+// buffer underflows in your output and are unable to increase your transport
+// stream's bitrate. For most workflows: We recommend that you keep the default
+// value, Disabled. To prevent decoder buffer underflows in your output, when
+// possible: Choose Enabled. Note that if MediaConvert prevents a decoder buffer
+// underflow in your output, output video quality is reduced and your job will
+// take longer to complete.
+const (
+	// M2tsPreventBufferUnderflowDisabled is a M2tsPreventBufferUnderflow enum value
+	M2tsPreventBufferUnderflowDisabled = "DISABLED"
+
+	// M2tsPreventBufferUnderflowEnabled is a M2tsPreventBufferUnderflow enum value
+	M2tsPreventBufferUnderflowEnabled = "ENABLED"
+)
+
+// M2tsPreventBufferUnderflow_Values returns all elements of the M2tsPreventBufferUnderflow enum
+func M2tsPreventBufferUnderflow_Values() []string {
+	return []string{
+		M2tsPreventBufferUnderflowDisabled,
+		M2tsPreventBufferUnderflowEnabled,
+	}
+}
+
 // When set to CBR, inserts null packets into transport stream to fill specified
 // bitrate. When set to VBR, the bitrate setting acts as the maximum bitrate,
 // but the output will not be padded up to that bitrate.
diff --git a/service/pinpoint/api.go b/service/pinpoint/api.go
index 9c8c5a2e8a8..e1316f60ad4 100644
--- a/service/pinpoint/api.go
+++ b/service/pinpoint/api.go
@@ -20677,6 +20677,10 @@ type EmailChannelRequest struct {
 	// Identity is a required field
 	Identity *string `type:"string" required:"true"`
 
+	// The ARN of an IAM role for Amazon Pinpoint to use to send email from your
+	// campaigns or journeys through Amazon SES.
+	OrchestrationSendingRoleArn *string `type:"string"`
+
 	// The ARN of the AWS Identity and Access Management (IAM) role that you want
 	// Amazon Pinpoint to use when it submits email-related event data for the channel.
 	RoleArn *string `type:"string"`
@@ -20740,6 +20744,12 @@ func (s *EmailChannelRequest) SetIdentity(v string) *EmailChannelRequest {
 	return s
 }
 
+// SetOrchestrationSendingRoleArn sets the OrchestrationSendingRoleArn field's value.
+func (s *EmailChannelRequest) SetOrchestrationSendingRoleArn(v string) *EmailChannelRequest {
+	s.OrchestrationSendingRoleArn = &v
+	return s
+}
+
 // SetRoleArn sets the RoleArn field's value.
 func (s *EmailChannelRequest) SetRoleArn(v string) *EmailChannelRequest {
 	s.RoleArn = &v
@@ -20792,6 +20802,10 @@ type EmailChannelResponse struct {
 	// The maximum number of emails that can be sent through the channel each second.
 	MessagesPerSecond *int64 `type:"integer"`
 
+	// The ARN of an IAM role for Amazon Pinpoint to use to send email from your
+	// campaigns or journeys through Amazon SES.
+	OrchestrationSendingRoleArn *string `type:"string"`
+
 	// The type of messaging or notification platform for the channel. For the email
 	// channel, this value is EMAIL.
 	//
@@ -20896,6 +20910,12 @@ func (s *EmailChannelResponse) SetMessagesPerSecond(v int64) *EmailChannelRespon
 	return s
 }
 
+// SetOrchestrationSendingRoleArn sets the OrchestrationSendingRoleArn field's value.
+func (s *EmailChannelResponse) SetOrchestrationSendingRoleArn(v string) *EmailChannelResponse {
+	s.OrchestrationSendingRoleArn = &v
+	return s
+}
+
 // SetPlatform sets the Platform field's value.
 func (s *EmailChannelResponse) SetPlatform(v string) *EmailChannelResponse {
 	s.Platform = &v
@@ -21812,8 +21832,6 @@ type EndpointMessageResult struct {
 	//    * THROTTLED - Amazon Pinpoint throttled the operation to send the message
 	//    to the endpoint.
 	//
-	//    * TIMEOUT - The message couldn't be sent within the timeout period.
-	//
 	//    * UNKNOWN_FAILURE - An unknown error occurred.
 	//
 	// DeliveryStatus is a required field
@@ -32729,8 +32747,6 @@ type MessageResult struct {
 	//    * THROTTLED - Amazon Pinpoint throttled the operation to send the message
 	//    to the endpoint address.
 	//
-	//    * TIMEOUT - The message couldn't be sent within the timeout period.
-	//
 	//    * UNKNOWN_FAILURE - An unknown error occurred.
 	//
 	// DeliveryStatus is a required field
diff --git a/service/rds/api.go b/service/rds/api.go
index c999c0adb09..f27fe2fb7b0 100644
--- a/service/rds/api.go
+++ b/service/rds/api.go
@@ -2281,6 +2281,9 @@ func (c *RDS) CreateDBInstanceReadReplicaRequest(input *CreateDBInstanceReadRepl
 //     You attempted to create more tenant databases than are permitted in your
 //     Amazon Web Services account.
 //
+//   - ErrCodeCertificateNotFoundFault "CertificateNotFound"
+//     CertificateIdentifier doesn't refer to an existing certificate.
+//
 // See also, https://docs.aws.amazon.com/goto/WebAPI/rds-2014-10-31/CreateDBInstanceReadReplica
 func (c *RDS) CreateDBInstanceReadReplica(input *CreateDBInstanceReadReplicaInput) (*CreateDBInstanceReadReplicaOutput, error) {
 	req, out := c.CreateDBInstanceReadReplicaRequest(input)
@@ -16200,6 +16203,9 @@ func (c *RDS) RestoreDBInstanceFromDBSnapshotRequest(input *RestoreDBInstanceFro
 //   - ErrCodeDBClusterSnapshotNotFoundFault "DBClusterSnapshotNotFoundFault"
 //     DBClusterSnapshotIdentifier doesn't refer to an existing DB cluster snapshot.
 //
+//   - ErrCodeCertificateNotFoundFault "CertificateNotFound"
+//     CertificateIdentifier doesn't refer to an existing certificate.
+//
 //   - ErrCodeTenantDatabaseQuotaExceededFault "TenantDatabaseQuotaExceeded"
 //     You attempted to create more tenant databases than are permitted in your
 //     Amazon Web Services account.
@@ -16353,6 +16359,9 @@ func (c *RDS) RestoreDBInstanceFromS3Request(input *RestoreDBInstanceFromS3Input
 //     The network type is invalid for the DB instance. Valid nework type values
 //     are IPV4 and DUAL.
 //
+//   - ErrCodeCertificateNotFoundFault "CertificateNotFound"
+//     CertificateIdentifier doesn't refer to an existing certificate.
+//
 // See also, https://docs.aws.amazon.com/goto/WebAPI/rds-2014-10-31/RestoreDBInstanceFromS3
 func (c *RDS) RestoreDBInstanceFromS3(input *RestoreDBInstanceFromS3Input) (*RestoreDBInstanceFromS3Output, error) {
 	req, out := c.RestoreDBInstanceFromS3Request(input)
@@ -16526,6 +16535,9 @@ func (c *RDS) RestoreDBInstanceToPointInTimeRequest(input *RestoreDBInstanceToPo
 //     You attempted to create more tenant databases than are permitted in your
 //     Amazon Web Services account.
 //
+//   - ErrCodeCertificateNotFoundFault "CertificateNotFound"
+//     CertificateIdentifier doesn't refer to an existing certificate.
+//
 // See also, https://docs.aws.amazon.com/goto/WebAPI/rds-2014-10-31/RestoreDBInstanceToPointInTime
 func (c *RDS) RestoreDBInstanceToPointInTime(input *RestoreDBInstanceToPointInTimeInput) (*RestoreDBInstanceToPointInTimeOutput, error) {
 	req, out := c.RestoreDBInstanceToPointInTimeRequest(input)
@@ -22228,6 +22240,7 @@ type CreateDBClusterInput struct {
 	// The DB engine mode of the DB cluster, either provisioned or serverless.
 	//
 	// The serverless engine mode only applies for Aurora Serverless v1 DB clusters.
+	// Aurora Serverless v2 DB clusters use the provisioned engine mode.
 	//
 	// For information about limitations and requirements for Serverless DB clusters,
 	// see the following sections in the Amazon Aurora User Guide:
@@ -24939,6 +24952,17 @@ type CreateDBInstanceReadReplicaInput struct {
 	// Example: us-east-1d
 	AvailabilityZone *string `type:"string"`
 
+	// The CA certificate identifier to use for the read replica's server certificate.
+	//
+	// This setting doesn't apply to RDS Custom DB instances.
+	//
+	// For more information, see Using SSL/TLS to encrypt a connection to a DB instance
+	// (https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html)
+	// in the Amazon RDS User Guide and Using SSL/TLS to encrypt a connection to
+	// a DB cluster (https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/UsingWithRDS.SSL.html)
+	// in the Amazon Aurora User Guide.
+	CACertificateIdentifier *string `type:"string"`
+
 	// Specifies whether to copy all tags from the read replica to snapshots of
 	// the read replica. By default, tags aren't copied.
 	CopyTagsToSnapshot *bool `type:"boolean"`
@@ -25511,6 +25535,12 @@ func (s *CreateDBInstanceReadReplicaInput) SetAvailabilityZone(v string) *Create
 	return s
 }
 
+// SetCACertificateIdentifier sets the CACertificateIdentifier field's value.
+func (s *CreateDBInstanceReadReplicaInput) SetCACertificateIdentifier(v string) *CreateDBInstanceReadReplicaInput {
+	s.CACertificateIdentifier = &v
+	return s
+}
+
 // SetCopyTagsToSnapshot sets the CopyTagsToSnapshot field's value.
 func (s *CreateDBInstanceReadReplicaInput) SetCopyTagsToSnapshot(v bool) *CreateDBInstanceReadReplicaInput {
 	s.CopyTagsToSnapshot = &v
@@ -57262,6 +57292,17 @@ type RestoreDBInstanceFromDBSnapshotInput struct {
 	// in the Amazon RDS User Guide.
 	BackupTarget *string `type:"string"`
 
+	// The CA certificate identifier to use for the DB instance's server certificate.
+	//
+	// This setting doesn't apply to RDS Custom DB instances.
+	//
+	// For more information, see Using SSL/TLS to encrypt a connection to a DB instance
+	// (https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html)
+	// in the Amazon RDS User Guide and Using SSL/TLS to encrypt a connection to
+	// a DB cluster (https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/UsingWithRDS.SSL.html)
+	// in the Amazon Aurora User Guide.
+	CACertificateIdentifier *string `type:"string"`
+
 	// Specifies whether to copy all tags from the restored DB instance to snapshots
 	// of the DB instance.
 	//
@@ -57707,6 +57748,12 @@ func (s *RestoreDBInstanceFromDBSnapshotInput) SetBackupTarget(v string) *Restor
 	return s
 }
 
+// SetCACertificateIdentifier sets the CACertificateIdentifier field's value.
+func (s *RestoreDBInstanceFromDBSnapshotInput) SetCACertificateIdentifier(v string) *RestoreDBInstanceFromDBSnapshotInput {
+	s.CACertificateIdentifier = &v
+	return s
+}
+
 // SetCopyTagsToSnapshot sets the CopyTagsToSnapshot field's value.
 func (s *RestoreDBInstanceFromDBSnapshotInput) SetCopyTagsToSnapshot(v bool) *RestoreDBInstanceFromDBSnapshotInput {
 	s.CopyTagsToSnapshot = &v
@@ -57995,6 +58042,17 @@ type RestoreDBInstanceFromS3Input struct {
 	// CreateDBInstance.
 	BackupRetentionPeriod *int64 `type:"integer"`
 
+	// The CA certificate identifier to use for the DB instance's server certificate.
+	//
+	// This setting doesn't apply to RDS Custom DB instances.
+	//
+	// For more information, see Using SSL/TLS to encrypt a connection to a DB instance
+	// (https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html)
+	// in the Amazon RDS User Guide and Using SSL/TLS to encrypt a connection to
+	// a DB cluster (https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/UsingWithRDS.SSL.html)
+	// in the Amazon Aurora User Guide.
+	CACertificateIdentifier *string `type:"string"`
+
 	// Specifies whether to copy all tags from the DB instance to snapshots of the
 	// DB instance. By default, tags are not copied.
 	CopyTagsToSnapshot *bool `type:"boolean"`
@@ -58466,6 +58524,12 @@ func (s *RestoreDBInstanceFromS3Input) SetBackupRetentionPeriod(v int64) *Restor
 	return s
 }
 
+// SetCACertificateIdentifier sets the CACertificateIdentifier field's value.
+func (s *RestoreDBInstanceFromS3Input) SetCACertificateIdentifier(v string) *RestoreDBInstanceFromS3Input {
+	s.CACertificateIdentifier = &v
+	return s
+}
+
 // SetCopyTagsToSnapshot sets the CopyTagsToSnapshot field's value.
 func (s *RestoreDBInstanceFromS3Input) SetCopyTagsToSnapshot(v bool) *RestoreDBInstanceFromS3Input {
 	s.CopyTagsToSnapshot = &v
@@ -58817,6 +58881,17 @@ type RestoreDBInstanceToPointInTimeInput struct {
 	// in the Amazon RDS User Guide.
 	BackupTarget *string `type:"string"`
 
+	// The CA certificate identifier to use for the DB instance's server certificate.
+	//
+	// This setting doesn't apply to RDS Custom DB instances.
+	//
+	// For more information, see Using SSL/TLS to encrypt a connection to a DB instance
+	// (https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html)
+	// in the Amazon RDS User Guide and Using SSL/TLS to encrypt a connection to
+	// a DB cluster (https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/UsingWithRDS.SSL.html)
+	// in the Amazon Aurora User Guide.
+	CACertificateIdentifier *string `type:"string"`
+
 	// Specifies whether to copy all tags from the restored DB instance to snapshots
 	// of the DB instance. By default, tags are not copied.
 	CopyTagsToSnapshot *bool `type:"boolean"`
@@ -59275,6 +59350,12 @@ func (s *RestoreDBInstanceToPointInTimeInput) SetBackupTarget(v string) *Restore
 	return s
 }
 
+// SetCACertificateIdentifier sets the CACertificateIdentifier field's value.
+func (s *RestoreDBInstanceToPointInTimeInput) SetCACertificateIdentifier(v string) *RestoreDBInstanceToPointInTimeInput {
+	s.CACertificateIdentifier = &v
+	return s
+}
+
 // SetCopyTagsToSnapshot sets the CopyTagsToSnapshot field's value.
 func (s *RestoreDBInstanceToPointInTimeInput) SetCopyTagsToSnapshot(v bool) *RestoreDBInstanceToPointInTimeInput {
 	s.CopyTagsToSnapshot = &v
diff --git a/service/rds/examples_test.go b/service/rds/examples_test.go
index 2d75edb29a7..a3afb78a1d1 100644
--- a/service/rds/examples_test.go
+++ b/service/rds/examples_test.go
@@ -962,6 +962,8 @@ func ExampleRDS_CreateDBInstanceReadReplica_shared00() {
 				fmt.Println(rds.ErrCodeNetworkTypeNotSupported, aerr.Error())
 			case rds.ErrCodeTenantDatabaseQuotaExceededFault:
 				fmt.Println(rds.ErrCodeTenantDatabaseQuotaExceededFault, aerr.Error())
+			case rds.ErrCodeCertificateNotFoundFault:
+				fmt.Println(rds.ErrCodeCertificateNotFoundFault, aerr.Error())
 			default:
 				fmt.Println(aerr.Error())
 			}
@@ -4220,6 +4222,8 @@ func ExampleRDS_RestoreDBInstanceFromDBSnapshot_shared00() {
 				fmt.Println(rds.ErrCodeNetworkTypeNotSupported, aerr.Error())
 			case rds.ErrCodeDBClusterSnapshotNotFoundFault:
 				fmt.Println(rds.ErrCodeDBClusterSnapshotNotFoundFault, aerr.Error())
+			case rds.ErrCodeCertificateNotFoundFault:
+				fmt.Println(rds.ErrCodeCertificateNotFoundFault, aerr.Error())
 			case rds.ErrCodeTenantDatabaseQuotaExceededFault:
 				fmt.Println(rds.ErrCodeTenantDatabaseQuotaExceededFault, aerr.Error())
 			default:
@@ -4299,6 +4303,8 @@ func ExampleRDS_RestoreDBInstanceToPointInTime_shared00() {
 				fmt.Println(rds.ErrCodeNetworkTypeNotSupported, aerr.Error())
 			case rds.ErrCodeTenantDatabaseQuotaExceededFault:
 				fmt.Println(rds.ErrCodeTenantDatabaseQuotaExceededFault, aerr.Error())
+			case rds.ErrCodeCertificateNotFoundFault:
+				fmt.Println(rds.ErrCodeCertificateNotFoundFault, aerr.Error())
 			default:
 				fmt.Println(aerr.Error())
 			}