feat(sources): update documentation

[aws-cdk-automation]

⚠️ This Pull Request updates daily and will overwrite all manual changes pushed to the branch

Updates the documentation source from upstream. See details in workflow run.

---

Automatically created by projen via the "update-source-documentation" workflow

[github-actions]

To work on this Pull Request, please create a new branch and PR. This prevents your work from being deleted by the automation.

Run the following commands inside the repo:

gh co 731
git switch -c fix-pr-731 && git push -u origin HEAD
gh pr create -t "fix: PR #731" --body "Fixes https://github.com/cdklabs/awscdk-service-spec/pull/731"

[github-actions]

@aws-cdk/aws-service-spec: Model database diff detected

├[~] service aws-applicationautoscaling
│ └ resources
│    ├[~] resource AWS::ApplicationAutoScaling::ScalableTarget
│    │ └ properties
│    │    ├ ResourceId: (documentation changed)
│    │    └ ScalableDimension: (documentation changed)
│    └[~] resource AWS::ApplicationAutoScaling::ScalingPolicy
│      └ properties
│         ├ ResourceId: (documentation changed)
│         └ ScalableDimension: (documentation changed)
├[~] service aws-cleanrooms
│ └ resources
│    └[~] resource AWS::CleanRooms::ConfiguredTable
│      └ types
│         └[~] type AnalysisRuleCustom
│           └  - documentation: A type of analysis rule that enables the table owner to approve custom SQL queries on their configured tables.
│              + documentation: A type of analysis rule that enables the table owner to approve custom SQL queries on their configured tables. It supports differential privacy.
├[~] service aws-elasticache
│ └ resources
│    └[~] resource AWS::ElastiCache::ServerlessCache
│      ├  - documentation: The AWS::ElastiCache::ServerlessCache resource creates an Amazon ElastiCache Serverless Cache.
│      │  + documentation: The resource representing a serverless cache.
│      ├ properties
│      │  ├ CacheUsageLimits: (documentation changed)
│      │  ├ DailySnapshotTime: (documentation changed)
│      │  ├ Description: (documentation changed)
│      │  ├ Engine: (documentation changed)
│      │  ├ FinalSnapshotName: (documentation changed)
│      │  ├ KmsKeyId: (documentation changed)
│      │  ├ MajorEngineVersion: (documentation changed)
│      │  ├ SecurityGroupIds: (documentation changed)
│      │  ├ ServerlessCacheName: (documentation changed)
│      │  ├ SnapshotArnsToRestore: (documentation changed)
│      │  ├ SnapshotRetentionLimit: (documentation changed)
│      │  ├ SubnetIds: (documentation changed)
│      │  ├ Tags: (documentation changed)
│      │  └ UserGroupId: (documentation changed)
│      ├ attributes
│      │  ├ ARN: (documentation changed)
│      │  ├ CreateTime: (documentation changed)
│      │  ├ Endpoint: (documentation changed)
│      │  ├ FullEngineVersion: (documentation changed)
│      │  ├ ReaderEndpoint: (documentation changed)
│      │  └ Status: (documentation changed)
│      └ types
│         ├[~] type CacheUsageLimits
│         │ ├  - documentation: The cache capacity limit of the Serverless Cache.
│         │ │  + documentation: The usage limits for storage and ElastiCache Processing Units for the cache.
│         │ └ properties
│         │    ├ DataStorage: (documentation changed)
│         │    └ ECPUPerSecond: (documentation changed)
│         ├[~] type DataStorage
│         │ ├  - documentation: The cached data capacity of the Serverless Cache.
│         │ │  + documentation: The data storage limit.
│         │ └ properties
│         │    ├ Maximum: (documentation changed)
│         │    └ Unit: (documentation changed)
│         ├[~] type ECPUPerSecond
│         │ ├  - documentation: The ECPU per second of the Serverless Cache.
│         │ │  + documentation: The configuration for the number of ElastiCache Processing Units (ECPU) the cache can consume per second.
│         │ └ properties
│         │    └ Maximum: (documentation changed)
│         └[~] type Endpoint
│           ├  - documentation: The address and the port.
│           │  + documentation: Represents the information required for client programs to connect to a cache node.
│           └ properties
│              ├ Address: (documentation changed)
│              └ Port: (documentation changed)
├[~] service aws-networkmanager
│ └ resources
│    └[~] resource AWS::NetworkManager::Device
│      └ attributes
│         └ CreatedAt: (documentation changed)
├[~] service aws-redshiftserverless
│ └ resources
│    └[~] resource AWS::RedshiftServerless::Workgroup
│      └ types
│         └[~] type Workgroup
│           └ properties
│              └ ConfigParameters: (documentation changed)
├[~] service aws-rolesanywhere
│ └ resources
│    ├[~] resource AWS::RolesAnywhere::Profile
│    │ ├  - documentation: Creates a Profile.
│    │ │  + documentation: Creates a *profile* , a list of the roles that Roles Anywhere service is trusted to assume. You use profiles to intersect permissions with IAM managed policies.
│    │ │  *Required permissions:* `rolesanywhere:CreateProfile` .
│    │ └ properties
│    │    ├ DurationSeconds: (documentation changed)
│    │    ├ Enabled: (documentation changed)
│    │    ├ ManagedPolicyArns: (documentation changed)
│    │    ├ Name: (documentation changed)
│    │    ├ RequireInstanceProperties: (documentation changed)
│    │    ├ RoleArns: (documentation changed)
│    │    ├ SessionPolicy: (documentation changed)
│    │    └ Tags: (documentation changed)
│    └[~] resource AWS::RolesAnywhere::TrustAnchor
│      ├  - documentation: Creates a TrustAnchor.
│      │  + documentation: Creates a trust anchor to establish trust between IAM Roles Anywhere and your certificate authority (CA). You can define a trust anchor as a reference to an AWS Private Certificate Authority ( AWS Private CA ) or by uploading a CA certificate. Your AWS workloads can authenticate with the trust anchor using certificates issued by the CA in exchange for temporary AWS credentials.
│      │  *Required permissions:* `rolesanywhere:CreateTrustAnchor` .
│      └ types
│         ├[~] type Source
│         │ ├  - documentation: Object representing the TrustAnchor type and its related certificate data.
│         │ │  + documentation: The trust anchor type and its related certificate data.
│         │ └ properties
│         │    ├ SourceData: (documentation changed)
│         │    └ SourceType: (documentation changed)
│         └[~] type SourceData
│           └  - documentation: A union object representing the data field of the TrustAnchor depending on its type
│              + documentation: The data field of the trust anchor depending on its type.
└[~] service aws-sagemaker
  └ resources
     ├[~] resource AWS::SageMaker::App
     │ └  - documentation: Creates a running app for the specified UserProfile. This operation is automatically invoked by Amazon SageMaker Studio upon access to the associated Domain, and when new kernel configurations are selected by the user. A user may have multiple Apps active simultaneously.
     │    + documentation: Creates a running app for the specified UserProfile. This operation is automatically invoked by Amazon SageMaker upon access to the associated Domain, and when new kernel configurations are selected by the user. A user may have multiple Apps active simultaneously.
     ├[~] resource AWS::SageMaker::DataQualityJobDefinition
     │ └ types
     │    └[~] type VpcConfig
     │      ├  - documentation: Specifies a VPC that your training jobs and hosted models have access to. Control access to and from your training and model containers by configuring the VPC. For more information, see [Protect Endpoints by Using an Amazon Virtual Private Cloud](https://docs.aws.amazon.com/sagemaker/latest/dg/host-vpc.html) and [Protect Training Jobs by Using an Amazon Virtual Private Cloud](https://docs.aws.amazon.com/sagemaker/latest/dg/train-vpc.html) .
     │      │  + documentation: Specifies an Amazon Virtual Private Cloud (VPC) that your SageMaker jobs, hosted models, and compute resources have access to. You can control access to and from your resources by configuring a VPC. For more information, see [Give SageMaker Access to Resources in your Amazon VPC](https://docs.aws.amazon.com/https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-give-access.html) .
     │      └ properties
     │         └ SecurityGroupIds: (documentation changed)
     ├[~] resource AWS::SageMaker::Domain
     │ ├  - documentation: Creates a `Domain` used by Amazon SageMaker Studio. A domain consists of an associated Amazon Elastic File System (EFS) volume, a list of authorized users, and a variety of security, application, policy, and Amazon Virtual Private Cloud (VPC) configurations. Users within a domain can share notebook files and other artifacts with each other.
     │ │  *EFS storage*
     │ │  When a domain is created, an EFS volume is created for use by all of the users within the domain. Each user receives a private home directory within the EFS volume for notebooks, Git repositories, and data files.
     │ │  SageMaker uses the AWS Key Management Service ( AWS KMS) to encrypt the EFS volume attached to the domain with an AWS managed key by default. For more control, you can specify a customer managed key. For more information, see [Protect Data at Rest Using Encryption](https://docs.aws.amazon.com/sagemaker/latest/dg/encryption-at-rest.html) .
     │ │  *VPC configuration*
     │ │  All SageMaker Studio traffic between the domain and the EFS volume is through the specified VPC and subnets. For other Studio traffic, you can specify the `AppNetworkAccessType` parameter. `AppNetworkAccessType` corresponds to the network access type that you choose when you onboard to Studio. The following options are available:
     │ │  - `PublicInternetOnly` - Non-EFS traffic goes through a VPC managed by Amazon SageMaker, which allows internet access. This is the default value.
     │ │  - `VpcOnly` - All Studio traffic is through the specified VPC and subnets. Internet access is disabled by default. To allow internet access, you must specify a NAT gateway.
     │ │  When internet access is disabled, you won't be able to run a Studio notebook or to train or host models unless your VPC has an interface endpoint to the SageMaker API and runtime or a NAT gateway and your security groups allow outbound connections.
     │ │  > NFS traffic over TCP on port 2049 needs to be allowed in both inbound and outbound rules in order to launch a SageMaker Studio app successfully. 
     │ │  For more information, see [Connect SageMaker Studio Notebooks to Resources in a VPC](https://docs.aws.amazon.com/sagemaker/latest/dg/studio-notebooks-and-internet-access.html) .
     │ │  + documentation: Creates a `Domain` . A domain consists of an associated Amazon Elastic File System (EFS) volume, a list of authorized users, and a variety of security, application, policy, and Amazon Virtual Private Cloud (VPC) configurations. Users within a domain can share notebook files and other artifacts with each other.
     │ │  *EFS storage*
     │ │  When a domain is created, an EFS volume is created for use by all of the users within the domain. Each user receives a private home directory within the EFS volume for notebooks, Git repositories, and data files.
     │ │  SageMaker uses the AWS Key Management Service ( AWS KMS) to encrypt the EFS volume attached to the domain with an AWS managed key by default. For more control, you can specify a customer managed key. For more information, see [Protect Data at Rest Using Encryption](https://docs.aws.amazon.com/sagemaker/latest/dg/encryption-at-rest.html) .
     │ │  *VPC configuration*
     │ │  All traffic between the domain and the EFS volume is through the specified VPC and subnets. For other traffic, you can specify the `AppNetworkAccessType` parameter. `AppNetworkAccessType` corresponds to the network access type that you choose when you onboard to the domain. The following options are available:
     │ │  - `PublicInternetOnly` - Non-EFS traffic goes through a VPC managed by Amazon SageMaker, which allows internet access. This is the default value.
     │ │  - `VpcOnly` - All traffic is through the specified VPC and subnets. Internet access is disabled by default. To allow internet access, you must specify a NAT gateway.
     │ │  When internet access is disabled, you won't be able to run a Amazon SageMaker Studio notebook or to train or host models unless your VPC has an interface endpoint to the SageMaker API and runtime or a NAT gateway and your security groups allow outbound connections.
     │ │  > NFS traffic over TCP on port 2049 needs to be allowed in both inbound and outbound rules in order to launch a Amazon SageMaker Studio app successfully. 
     │ │  For more information, see [Connect Amazon SageMaker Studio Notebooks to Resources in a VPC](https://docs.aws.amazon.com/sagemaker/latest/dg/studio-notebooks-and-internet-access.html) .
     │ └ types
     │    └[~] type UserSettings
     │      └ properties
     │         ├ SecurityGroups: (documentation changed)
     │         └ SharingSettings: (documentation changed)
     ├[~] resource AWS::SageMaker::Model
     │ └ types
     │    └[~] type VpcConfig
     │      ├  - documentation: Specifies a VPC that your training jobs and hosted models have access to. Control access to and from your training and model containers by configuring the VPC. For more information, see [Protect Endpoints by Using an Amazon Virtual Private Cloud](https://docs.aws.amazon.com/sagemaker/latest/dg/host-vpc.html) and [Protect Training Jobs by Using an Amazon Virtual Private Cloud](https://docs.aws.amazon.com/sagemaker/latest/dg/train-vpc.html) .
     │      │  + documentation: Specifies an Amazon Virtual Private Cloud (VPC) that your SageMaker jobs, hosted models, and compute resources have access to. You can control access to and from your resources by configuring a VPC. For more information, see [Give SageMaker Access to Resources in your Amazon VPC](https://docs.aws.amazon.com/https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-give-access.html) .
     │      └ properties
     │         └ SecurityGroupIds: (documentation changed)
     ├[~] resource AWS::SageMaker::ModelBiasJobDefinition
     │ └ types
     │    └[~] type VpcConfig
     │      ├  - documentation: Specifies a VPC that your training jobs and hosted models have access to. Control access to and from your training and model containers by configuring the VPC. For more information, see [Protect Endpoints by Using an Amazon Virtual Private Cloud](https://docs.aws.amazon.com/sagemaker/latest/dg/host-vpc.html) and [Protect Training Jobs by Using an Amazon Virtual Private Cloud](https://docs.aws.amazon.com/sagemaker/latest/dg/train-vpc.html) .
     │      │  + documentation: Specifies an Amazon Virtual Private Cloud (VPC) that your SageMaker jobs, hosted models, and compute resources have access to. You can control access to and from your resources by configuring a VPC. For more information, see [Give SageMaker Access to Resources in your Amazon VPC](https://docs.aws.amazon.com/https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-give-access.html) .
     │      └ properties
     │         └ SecurityGroupIds: (documentation changed)
     ├[~] resource AWS::SageMaker::ModelExplainabilityJobDefinition
     │ └ types
     │    └[~] type VpcConfig
     │      ├  - documentation: Specifies a VPC that your training jobs and hosted models have access to. Control access to and from your training and model containers by configuring the VPC. For more information, see [Protect Endpoints by Using an Amazon Virtual Private Cloud](https://docs.aws.amazon.com/sagemaker/latest/dg/host-vpc.html) and [Protect Training Jobs by Using an Amazon Virtual Private Cloud](https://docs.aws.amazon.com/sagemaker/latest/dg/train-vpc.html) .
     │      │  + documentation: Specifies an Amazon Virtual Private Cloud (VPC) that your SageMaker jobs, hosted models, and compute resources have access to. You can control access to and from your resources by configuring a VPC. For more information, see [Give SageMaker Access to Resources in your Amazon VPC](https://docs.aws.amazon.com/https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-give-access.html) .
     │      └ properties
     │         └ SecurityGroupIds: (documentation changed)
     ├[~] resource AWS::SageMaker::ModelQualityJobDefinition
     │ └ types
     │    └[~] type VpcConfig
     │      ├  - documentation: Specifies a VPC that your training jobs and hosted models have access to. Control access to and from your training and model containers by configuring the VPC. For more information, see [Protect Endpoints by Using an Amazon Virtual Private Cloud](https://docs.aws.amazon.com/sagemaker/latest/dg/host-vpc.html) and [Protect Training Jobs by Using an Amazon Virtual Private Cloud](https://docs.aws.amazon.com/sagemaker/latest/dg/train-vpc.html) .
     │      │  + documentation: Specifies an Amazon Virtual Private Cloud (VPC) that your SageMaker jobs, hosted models, and compute resources have access to. You can control access to and from your resources by configuring a VPC. For more information, see [Give SageMaker Access to Resources in your Amazon VPC](https://docs.aws.amazon.com/https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-give-access.html) .
     │      └ properties
     │         └ SecurityGroupIds: (documentation changed)
     ├[~] resource AWS::SageMaker::MonitoringSchedule
     │ └ types
     │    └[~] type VpcConfig
     │      ├  - documentation: Specifies a VPC that your training jobs and hosted models have access to. Control access to and from your training and model containers by configuring the VPC. For more information, see [Protect Endpoints by Using an Amazon Virtual Private Cloud](https://docs.aws.amazon.com/sagemaker/latest/dg/host-vpc.html) and [Protect Training Jobs by Using an Amazon Virtual Private Cloud](https://docs.aws.amazon.com/sagemaker/latest/dg/train-vpc.html) .
     │      │  + documentation: Specifies an Amazon Virtual Private Cloud (VPC) that your SageMaker jobs, hosted models, and compute resources have access to. You can control access to and from your resources by configuring a VPC. For more information, see [Give SageMaker Access to Resources in your Amazon VPC](https://docs.aws.amazon.com/https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-give-access.html) .
     │      └ properties
     │         └ SecurityGroupIds: (documentation changed)
     └[~] resource AWS::SageMaker::UserProfile
       └ types
          └[~] type UserSettings
            └ properties
               ├ SecurityGroups: (documentation changed)
               └ SharingSettings: (documentation changed)