From 39e810c4bf4fece46fde3afcd68b566dd503a03c Mon Sep 17 00:00:00 2001 From: awstools Date: Mon, 25 Mar 2024 18:22:50 +0000 Subject: [PATCH] feat(client-global-accelerator): AWS Global Accelerator now supports cross-account sharing for bring your own IP addresses. --- .../CreateCrossAccountAttachmentCommand.ts | 27 +++-- .../DeleteCrossAccountAttachmentCommand.ts | 20 +--- .../DescribeCrossAccountAttachmentCommand.ts | 3 +- .../ListCrossAccountAttachmentsCommand.ts | 3 +- ...ListCrossAccountResourceAccountsCommand.ts | 5 +- .../ListCrossAccountResourcesCommand.ts | 3 +- .../UpdateCrossAccountAttachmentCommand.ts | 29 ++--- .../src/models/models_0.ts | 105 +++++++++++++----- .../aws-models/global-accelerator.json | 75 +++++++------ 9 files changed, 163 insertions(+), 107 deletions(-) diff --git a/clients/client-global-accelerator/src/commands/CreateCrossAccountAttachmentCommand.ts b/clients/client-global-accelerator/src/commands/CreateCrossAccountAttachmentCommand.ts index 7aae353baa71..826a51d55a36 100644 --- a/clients/client-global-accelerator/src/commands/CreateCrossAccountAttachmentCommand.ts +++ b/clients/client-global-accelerator/src/commands/CreateCrossAccountAttachmentCommand.ts @@ -37,14 +37,23 @@ export interface CreateCrossAccountAttachmentCommandOutput /** *

Create a cross-account attachment in Global Accelerator. You create a cross-account attachment to - * specify the principals who have permission to add to accelerators in their own - * account the resources in your account that you also list in the attachment.

+ * specify the principals who have permission to work with resources + * in accelerators in their own account. You specify, in the same attachment, the resources that are shared.

*

A principal can be an Amazon Web Services account number or the Amazon Resource Name (ARN) for an - * accelerator. For account numbers that are listed as principals, to add a resource listed in the attachment to an accelerator, - * you must sign in to an account specified as a principal. Then you can add the resources that are listed - * to any of your accelerators. If an accelerator ARN is listed in the cross-account attachment as a principal, - * anyone with permission to make updates to the accelerator can add as endpoints resources that are listed in the + * accelerator. For account numbers that are listed as principals, to work with a resource listed in the attachment, + * you must sign in to an account specified as a principal. Then, you can work with resources that are listed, + * with any of your accelerators. If an accelerator ARN is listed in the cross-account attachment as a principal, + * anyone with permission to make updates to the accelerator can work with resources that are listed in the * attachment.

+ *

Specify each principal and resource separately. To specify two CIDR address pools, list + * them individually under Resources, and so on. For a command line operation, for example, + * you might use a statement like the following:

+ *

+ * "Resources": [\{"Cidr": "169.254.60.0/24"\},\{"Cidr": "169.254.59.0/24"\}] + *

+ *

For more information, see + * Working with cross-account attachments and resources in Global Accelerator in the + * Global Accelerator Developer Guide.

* @example * Use a bare-bones client and the command you need to make an API call. * ```javascript @@ -58,7 +67,8 @@ export interface CreateCrossAccountAttachmentCommandOutput * ], * Resources: [ // Resources * { // Resource - * EndpointId: "STRING_VALUE", // required + * EndpointId: "STRING_VALUE", + * Cidr: "STRING_VALUE", * Region: "STRING_VALUE", * }, * ], @@ -81,7 +91,8 @@ export interface CreateCrossAccountAttachmentCommandOutput * // ], * // Resources: [ // Resources * // { // Resource - * // EndpointId: "STRING_VALUE", // required + * // EndpointId: "STRING_VALUE", + * // Cidr: "STRING_VALUE", * // Region: "STRING_VALUE", * // }, * // ], diff --git a/clients/client-global-accelerator/src/commands/DeleteCrossAccountAttachmentCommand.ts b/clients/client-global-accelerator/src/commands/DeleteCrossAccountAttachmentCommand.ts index a28ab3d7b256..5ea22511502d 100644 --- a/clients/client-global-accelerator/src/commands/DeleteCrossAccountAttachmentCommand.ts +++ b/clients/client-global-accelerator/src/commands/DeleteCrossAccountAttachmentCommand.ts @@ -36,22 +36,10 @@ export interface DeleteCrossAccountAttachmentCommandOutput extends __MetadataBea /** *

Delete a cross-account attachment. When you delete an attachment, Global Accelerator revokes the permission * to use the resources in the attachment from all principals in the list of principals. Global Accelerator - * revokes the permission for specific resources by doing the following:

- * - *

If there are overlapping permissions provided by multiple cross-account attachments, - * Global Accelerator only removes endpoints if there are no current cross-account attachments that provide - * access permission. For example, if you delete a cross-account attachment that lists an - * accelerator as a principal, but another cross-account attachment includes the account ID - * that owns that accelerator, endpoints will not be removed from the accelerator.

+ * revokes the permission for specific resources.

+ *

For more information, see + * Working with cross-account attachments and resources in Global Accelerator in the + * Global Accelerator Developer Guide.

* @example * Use a bare-bones client and the command you need to make an API call. * ```javascript diff --git a/clients/client-global-accelerator/src/commands/DescribeCrossAccountAttachmentCommand.ts b/clients/client-global-accelerator/src/commands/DescribeCrossAccountAttachmentCommand.ts index 3afa41a80af0..333c3f7bb016 100644 --- a/clients/client-global-accelerator/src/commands/DescribeCrossAccountAttachmentCommand.ts +++ b/clients/client-global-accelerator/src/commands/DescribeCrossAccountAttachmentCommand.ts @@ -57,7 +57,8 @@ export interface DescribeCrossAccountAttachmentCommandOutput * // ], * // Resources: [ // Resources * // { // Resource - * // EndpointId: "STRING_VALUE", // required + * // EndpointId: "STRING_VALUE", + * // Cidr: "STRING_VALUE", * // Region: "STRING_VALUE", * // }, * // ], diff --git a/clients/client-global-accelerator/src/commands/ListCrossAccountAttachmentsCommand.ts b/clients/client-global-accelerator/src/commands/ListCrossAccountAttachmentsCommand.ts index fd491dcad0f3..2d8ed2f9e9e8 100644 --- a/clients/client-global-accelerator/src/commands/ListCrossAccountAttachmentsCommand.ts +++ b/clients/client-global-accelerator/src/commands/ListCrossAccountAttachmentsCommand.ts @@ -56,7 +56,8 @@ export interface ListCrossAccountAttachmentsCommandOutput * // ], * // Resources: [ // Resources * // { // Resource - * // EndpointId: "STRING_VALUE", // required + * // EndpointId: "STRING_VALUE", + * // Cidr: "STRING_VALUE", * // Region: "STRING_VALUE", * // }, * // ], diff --git a/clients/client-global-accelerator/src/commands/ListCrossAccountResourceAccountsCommand.ts b/clients/client-global-accelerator/src/commands/ListCrossAccountResourceAccountsCommand.ts index e0231c45eed5..39c497417f91 100644 --- a/clients/client-global-accelerator/src/commands/ListCrossAccountResourceAccountsCommand.ts +++ b/clients/client-global-accelerator/src/commands/ListCrossAccountResourceAccountsCommand.ts @@ -36,7 +36,10 @@ export interface ListCrossAccountResourceAccountsCommandOutput __MetadataBearer {} /** - *

List the accounts that have cross-account endpoints.

+ *

List the accounts that have cross-account resources.

+ *

For more information, see + * Working with cross-account attachments and resources in Global Accelerator in the + * Global Accelerator Developer Guide.

* @example * Use a bare-bones client and the command you need to make an API call. * ```javascript diff --git a/clients/client-global-accelerator/src/commands/ListCrossAccountResourcesCommand.ts b/clients/client-global-accelerator/src/commands/ListCrossAccountResourcesCommand.ts index 4092ad3c8643..4af3c3586241 100644 --- a/clients/client-global-accelerator/src/commands/ListCrossAccountResourcesCommand.ts +++ b/clients/client-global-accelerator/src/commands/ListCrossAccountResourcesCommand.ts @@ -31,7 +31,7 @@ export interface ListCrossAccountResourcesCommandInput extends ListCrossAccountR export interface ListCrossAccountResourcesCommandOutput extends ListCrossAccountResourcesResponse, __MetadataBearer {} /** - *

List the cross-account endpoints available to add to an accelerator.

+ *

List the cross-account resources available to work with.

* @example * Use a bare-bones client and the command you need to make an API call. * ```javascript @@ -50,6 +50,7 @@ export interface ListCrossAccountResourcesCommandOutput extends ListCrossAccount * // CrossAccountResources: [ // CrossAccountResources * // { // CrossAccountResource * // EndpointId: "STRING_VALUE", + * // Cidr: "STRING_VALUE", * // AttachmentArn: "STRING_VALUE", * // }, * // ], diff --git a/clients/client-global-accelerator/src/commands/UpdateCrossAccountAttachmentCommand.ts b/clients/client-global-accelerator/src/commands/UpdateCrossAccountAttachmentCommand.ts index ae5242d8c5b5..ebd15a8f99dc 100644 --- a/clients/client-global-accelerator/src/commands/UpdateCrossAccountAttachmentCommand.ts +++ b/clients/client-global-accelerator/src/commands/UpdateCrossAccountAttachmentCommand.ts @@ -38,22 +38,10 @@ export interface UpdateCrossAccountAttachmentCommandOutput /** *

Update a cross-account attachment to add or remove principals or resources. When you update * an attachment to remove a principal (account ID or accelerator) or a resource, Global Accelerator - * revokes the permission for specific resources by doing the following:

- * - *

If there are overlapping permissions provided by multiple cross-account attachments, - * Global Accelerator only removes endpoints if there are no current cross-account attachments that provide - * access permission. For example, if you delete a cross-account attachment that lists an - * accelerator as a principal, but another cross-account attachment includes the account ID - * that owns that accelerator, endpoints will not be removed from the accelerator.

+ * revokes the permission for specific resources.

+ *

For more information, see + * Working with cross-account attachments and resources in Global Accelerator in the + * Global Accelerator Developer Guide.

* @example * Use a bare-bones client and the command you need to make an API call. * ```javascript @@ -71,13 +59,15 @@ export interface UpdateCrossAccountAttachmentCommandOutput * ], * AddResources: [ // Resources * { // Resource - * EndpointId: "STRING_VALUE", // required + * EndpointId: "STRING_VALUE", + * Cidr: "STRING_VALUE", * Region: "STRING_VALUE", * }, * ], * RemoveResources: [ * { - * EndpointId: "STRING_VALUE", // required + * EndpointId: "STRING_VALUE", + * Cidr: "STRING_VALUE", * Region: "STRING_VALUE", * }, * ], @@ -93,7 +83,8 @@ export interface UpdateCrossAccountAttachmentCommandOutput * // ], * // Resources: [ // Resources * // { // Resource - * // EndpointId: "STRING_VALUE", // required + * // EndpointId: "STRING_VALUE", + * // Cidr: "STRING_VALUE", * // Region: "STRING_VALUE", * // }, * // ], diff --git a/clients/client-global-accelerator/src/models/models_0.ts b/clients/client-global-accelerator/src/models/models_0.ts index 32c419104405..01e00e43ae22 100644 --- a/clients/client-global-accelerator/src/models/models_0.ts +++ b/clients/client-global-accelerator/src/models/models_0.ts @@ -294,7 +294,7 @@ export interface CustomRoutingEndpointConfiguration { /** *

The Amazon Resource Name (ARN) of the cross-account attachment that specifies the endpoints (resources) - * that can be added to accelerators and principals that have permission to add the endpoints to accelerators.

+ * that can be added to accelerators and principals that have permission to add the endpoints.

* @public */ AttachmentArn?: string; @@ -490,7 +490,7 @@ export interface EndpointConfiguration { * Resource Name (ARN) of the resource. If the endpoint is an Elastic IP address, this is the Elastic IP address * allocation ID. For Amazon EC2 instances, this is the EC2 instance ID. A resource must be valid and active * when you add it as an endpoint.

- *

An Application Load Balancer can be either internal or internet-facing.

+ *

For cross-account endpoints, this must be the ARN of the resource.

* @public */ EndpointId?: string; @@ -521,7 +521,7 @@ export interface EndpointConfiguration { /** *

The Amazon Resource Name (ARN) of the cross-account attachment that specifies the endpoints (resources) - * that can be added to accelerators and principals that have permission to add the endpoints to accelerators.

+ * that can be added to accelerators and principals that have permission to add the endpoints.

* @public */ AttachmentArn?: string; @@ -657,6 +657,9 @@ export interface AdvertiseByoipCidrRequest { /** *

The address range, in CIDR notation. This must be the exact range that you provisioned. * You can't advertise only a portion of the provisioned range.

+ *

For more information, see + * Bring your own IP addresses (BYOIP) in + * the Global Accelerator Developer Guide.

* @public */ Cidr: string | undefined; @@ -783,6 +786,9 @@ export type ByoipCidrState = (typeof ByoipCidrState)[keyof typeof ByoipCidrState export interface ByoipCidr { /** *

The address range, in CIDR notation.

+ *

For more information, see + * Bring your own IP addresses (BYOIP) in + * the Global Accelerator Developer Guide.

* @public */ Cidr?: string; @@ -950,18 +956,32 @@ export class AssociatedListenerFoundException extends __BaseException { } /** - *

An Amazon Web Services resource that is supported by Global Accelerator and can be added as an endpoint for an accelerator.

+ *

A resource is one of the following: the ARN for an Amazon Web Services resource that is supported by + * Global Accelerator to be added as an endpoint, or a CIDR range that specifies a bring your own IP (BYOIP) address pool.

* @public */ export interface Resource { /** - *

The endpoint ID for the endpoint (Amazon Web Services resource).

+ *

The endpoint ID for the endpoint that is specified as a Amazon Web Services resource.

+ *

An endpoint ID for the cross-account feature is the ARN of an Amazon Web Services resource, such as a + * Network Load Balancer, that Global Accelerator supports as an endpoint for an accelerator.

* @public */ - EndpointId: string | undefined; + EndpointId?: string; + + /** + *

An IP address range, in CIDR format, that is specified as resource. The address must + * be provisioned and advertised in Global Accelerator by following the bring your own IP address (BYOIP) process + * for Global Accelerator

+ *

For more information, see + * Bring your own IP addresses (BYOIP) in + * the Global Accelerator Developer Guide.

+ * @public + */ + Cidr?: string; /** - *

The Amazon Web Services Region where a resource is located.

+ *

The Amazon Web Services Region where a shared endpoint resource is located.

* @public */ Region?: string; @@ -969,8 +989,8 @@ export interface Resource { /** *

A cross-account attachment in Global Accelerator. A cross-account attachment - * specifies the principals who have permission to add to accelerators in their own - * account the resources in your account that you also list in the attachment.

+ * specifies the principals who have permission to work with resources + * in your account, which you also list in the attachment.

* @public */ export interface Attachment { @@ -1165,15 +1185,16 @@ export interface CreateCrossAccountAttachmentRequest { Name: string | undefined; /** - *

The principals to list in the cross-account attachment. A principal can be an Amazon Web Services account + *

The principals to include in the cross-account attachment. A principal can be an Amazon Web Services account * number or the Amazon Resource Name (ARN) for an accelerator.

* @public */ Principals?: string[]; /** - *

The Amazon Resource Names (ARNs) for the resources to list in the cross-account attachment. A resource can - * be any supported Amazon Web Services resource type for Global Accelerator.

+ *

The Amazon Resource Names (ARNs) for the resources to include in the cross-account attachment. A resource can + * be any supported Amazon Web Services resource type for Global Accelerator or a CIDR range for a + * bring your own IP address (BYOIP) address pool.

* @public */ Resources?: Resource[]; @@ -1186,7 +1207,7 @@ export interface CreateCrossAccountAttachmentRequest { IdempotencyToken?: string; /** - *

Create tags for cross-account attachment.

+ *

Add tags for a cross-account attachment.

*

For more information, see Tagging * in Global Accelerator in the Global Accelerator Developer Guide.

* @public @@ -1969,8 +1990,12 @@ export interface CreateListenerResponse { } /** - *

An endpoint (Amazon Web Services resource) that is listed in a cross-account attachment and - * can be added to an accelerator by specified principals, that are also listed in the attachment.

+ *

An endpoint (Amazon Web Services resource) or an IP address range, in CIDR format, that is + * listed in a cross-account attachment. A cross-account resource can be added to an accelerator by + * specified principals, which are also listed in the attachment.

+ *

For more information, see + * Working with cross-account attachments and resources in Global Accelerator in the + * Global Accelerator Developer Guide.

* @public */ export interface CrossAccountResource { @@ -1982,8 +2007,19 @@ export interface CrossAccountResource { EndpointId?: string; /** - *

The Amazon Resource Name (ARN) of the cross-account attachment that specifies the endpoints (resources) - * that can be added to accelerators and principals that have permission to add the endpoints to accelerators.

+ *

An IP address range, in CIDR format, that is specified as an Amazon Web Services resource. The address must + * be provisioned and advertised in Global Accelerator by following the bring your own IP address (BYOIP) process + * for Global Accelerator.

+ *

For more information, see + * Bring your own IP addresses (BYOIP) in + * the Global Accelerator Developer Guide.

+ * @public + */ + Cidr?: string; + + /** + *

The Amazon Resource Name (ARN) of the cross-account attachment that specifies the resources (endpoints or + * CIDR range) that can be added to accelerators and principals that have permission to add them.

* @public */ AttachmentArn?: string; @@ -2166,6 +2202,9 @@ export interface DeprovisionByoipCidrRequest { /** *

The address range, in CIDR notation. The prefix must be the same prefix that you specified * when you provisioned the address range.

+ *

For more information, see + * Bring your own IP addresses (BYOIP) in + * the Global Accelerator Developer Guide.

* @public */ Cidr: string | undefined; @@ -2635,8 +2674,8 @@ export interface ListCrossAccountResourceAccountsRequest {} */ export interface ListCrossAccountResourceAccountsResponse { /** - *

The account IDs of principals (resource owners) in a cross-account attachment who can add endpoints (resources) listed - * in the same attachment.

+ *

The account IDs of principals (resource owners) in a cross-account attachment who can work + * with resources listed in the same attachment.

* @public */ ResourceOwnerAwsAccountIds?: string[]; @@ -2659,7 +2698,7 @@ export interface ListCrossAccountResourcesRequest { ResourceOwnerAwsAccountId: string | undefined; /** - *

The number of cross-account endpoints objects that you want to return with this call. The default value is 10.

+ *

The number of cross-account resource objects that you want to return with this call. The default value is 10.

* @public */ MaxResults?: number; @@ -2676,7 +2715,7 @@ export interface ListCrossAccountResourcesRequest { */ export interface ListCrossAccountResourcesResponse { /** - *

The endpoints attached to an accelerator in a cross-account attachment.

+ *

The cross-account resources used with an accelerator.

* @public */ CrossAccountResources?: CrossAccountResource[]; @@ -3050,7 +3089,10 @@ export interface ProvisionByoipCidrRequest { /** *

The public IPv4 address range, in CIDR notation. The most specific IP prefix that you can * specify is /24. The address range cannot overlap with another address range that you've brought - * to this or another Region.

+ * to this Amazon Web Services Region or another Region.

+ *

For more information, see + * Bring your own IP addresses (BYOIP) in + * the Global Accelerator Developer Guide.

* @public */ Cidr: string | undefined; @@ -3263,7 +3305,8 @@ export interface UpdateCrossAccountAttachmentRequest { /** *

The principals to add to the cross-account attachment. A principal is an account or the Amazon Resource Name (ARN) - * of an accelerator that the attachment gives permission to add the resources from another account, listed in the attachment.

+ * of an accelerator that the attachment gives permission to work with resources from another account. The resources + * are also listed in the attachment.

*

To add more than one principal, separate the account numbers or accelerator ARNs, or both, with commas.

* @public */ @@ -3271,23 +3314,24 @@ export interface UpdateCrossAccountAttachmentRequest { /** *

The principals to remove from the cross-account attachment. A principal is an account or the Amazon Resource Name (ARN) - * of an accelerator that is given permission to add the resources from another account, listed in the cross-account attachment.

+ * of an accelerator that the attachment gives permission to work with resources from another account. The resources + * are also listed in the attachment.

*

To remove more than one principal, separate the account numbers or accelerator ARNs, or both, with commas.

* @public */ RemovePrincipals?: string[]; /** - *

The resources to add to the cross-account attachment. A resource listed in a cross-account attachment can be added - * to an accelerator by the principals that are listed in the attachment.

+ *

The resources to add to the cross-account attachment. A resource listed in a cross-account attachment can be used + * with an accelerator by the principals that are listed in the attachment.

*

To add more than one resource, separate the resource ARNs with commas.

* @public */ AddResources?: Resource[]; /** - *

The resources to remove from the cross-account attachment. A resource listed in a cross-account attachment can be added - * to an accelerator fy principals that are listed in the cross-account attachment.

+ *

The resources to remove from the cross-account attachment. A resource listed in a cross-account attachment can be used + * with an accelerator by the principals that are listed in the attachment.

*

To remove more than one resource, separate the resource ARNs with commas.

* @public */ @@ -3568,6 +3612,9 @@ export interface UpdateListenerResponse { export interface WithdrawByoipCidrRequest { /** *

The address range, in CIDR notation.

+ *

For more information, see + * Bring your own IP addresses (BYOIP) in + * the Global Accelerator Developer Guide.

* @public */ Cidr: string | undefined; @@ -3578,7 +3625,7 @@ export interface WithdrawByoipCidrRequest { */ export interface WithdrawByoipCidrResponse { /** - *

Information about the address pool.

+ *

Information about the BYOIP address pool.

* @public */ ByoipCidr?: ByoipCidr; diff --git a/codegen/sdk-codegen/aws-models/global-accelerator.json b/codegen/sdk-codegen/aws-models/global-accelerator.json index 646c161f2666..d136e8b677c2 100644 --- a/codegen/sdk-codegen/aws-models/global-accelerator.json +++ b/codegen/sdk-codegen/aws-models/global-accelerator.json @@ -403,7 +403,7 @@ "Cidr": { "target": "com.amazonaws.globalaccelerator#GenericString", "traits": { - "smithy.api#documentation": "

The address range, in CIDR notation. This must be the exact range that you provisioned. \n\t\t\tYou can't advertise only a portion of the provisioned range.

", + "smithy.api#documentation": "

The address range, in CIDR notation. This must be the exact range that you provisioned. \n\t\t\tYou can't advertise only a portion of the provisioned range.

\n

For more information, see\n\t\t\tBring your own IP addresses (BYOIP) in \n\t\t\tthe Global Accelerator Developer Guide.

", "smithy.api#required": {} } } @@ -556,7 +556,7 @@ } }, "traits": { - "smithy.api#documentation": "

A cross-account attachment in Global Accelerator. A cross-account attachment\n\t\t\tspecifies the principals who have permission to add to accelerators in their own\n\t\t\taccount the resources in your account that you also list in the attachment.

" + "smithy.api#documentation": "

A cross-account attachment in Global Accelerator. A cross-account attachment\n\t\t\tspecifies the principals who have permission to work with resources \n\t\t\tin your account, which you also list in the attachment.

" } }, "com.amazonaws.globalaccelerator#AttachmentName": { @@ -610,7 +610,7 @@ "Cidr": { "target": "com.amazonaws.globalaccelerator#GenericString", "traits": { - "smithy.api#documentation": "

The address range, in CIDR notation.

" + "smithy.api#documentation": "

The address range, in CIDR notation.

\n

For more information, see\n\t\t\tBring your own IP addresses (BYOIP) in \n\t\t\tthe Global Accelerator Developer Guide.

" } }, "State": { @@ -908,7 +908,7 @@ } ], "traits": { - "smithy.api#documentation": "

Create a cross-account attachment in Global Accelerator. You create a cross-account attachment to\n\t\t\tspecify the principals who have permission to add to accelerators in their own\n\t\t\taccount the resources in your account that you also list in the attachment.

\n

A principal can be an Amazon Web Services account number or the Amazon Resource Name (ARN) for an \n\t\t\taccelerator. For account numbers that are listed as principals, to add a resource listed in the attachment to an accelerator,\n\t\t\tyou must sign in to an account specified as a principal. Then you can add the resources that are listed \n\t\t\tto any of your accelerators. If an accelerator ARN is listed in the cross-account attachment as a principal, \n\t\t\tanyone with permission to make updates to the accelerator can add as endpoints resources that are listed in the \n\t\t\tattachment.

" + "smithy.api#documentation": "

Create a cross-account attachment in Global Accelerator. You create a cross-account attachment to\n\t\t\tspecify the principals who have permission to work with resources\n\t\t\tin accelerators in their own account. You specify, in the same attachment, the resources that are shared.

\n

A principal can be an Amazon Web Services account number or the Amazon Resource Name (ARN) for an \n\t\t\taccelerator. For account numbers that are listed as principals, to work with a resource listed in the attachment,\n\t\t\tyou must sign in to an account specified as a principal. Then, you can work with resources that are listed, \n\t\t\twith any of your accelerators. If an accelerator ARN is listed in the cross-account attachment as a principal, \n\t\t\tanyone with permission to make updates to the accelerator can work with resources that are listed in the \n\t\t\tattachment.

\n

Specify each principal and resource separately. To specify two CIDR address pools, list\n\t\t\tthem individually under Resources, and so on. For a command line operation, for example,\n\t\t\tyou might use a statement like the following:

\n

\n \"Resources\": [{\"Cidr\": \"169.254.60.0/24\"},{\"Cidr\": \"169.254.59.0/24\"}]\n

\n

For more information, see \n\t\t\tWorking with cross-account attachments and resources in Global Accelerator in the \n\t\t\t\tGlobal Accelerator Developer Guide.

" } }, "com.amazonaws.globalaccelerator#CreateCrossAccountAttachmentRequest": { @@ -924,13 +924,13 @@ "Principals": { "target": "com.amazonaws.globalaccelerator#Principals", "traits": { - "smithy.api#documentation": "

The principals to list in the cross-account attachment. A principal can be an Amazon Web Services account\n\t\t\tnumber or the Amazon Resource Name (ARN) for an accelerator.

" + "smithy.api#documentation": "

The principals to include in the cross-account attachment. A principal can be an Amazon Web Services account\n\t\t\tnumber or the Amazon Resource Name (ARN) for an accelerator.

" } }, "Resources": { "target": "com.amazonaws.globalaccelerator#Resources", "traits": { - "smithy.api#documentation": "

The Amazon Resource Names (ARNs) for the resources to list in the cross-account attachment. A resource can\n\t\t\tbe any supported Amazon Web Services resource type for Global Accelerator.

" + "smithy.api#documentation": "

The Amazon Resource Names (ARNs) for the resources to include in the cross-account attachment. A resource can\n\t\t\tbe any supported Amazon Web Services resource type for Global Accelerator or a CIDR range for a\n\t\t\tbring your own IP address (BYOIP) address pool.

" } }, "IdempotencyToken": { @@ -944,7 +944,7 @@ "Tags": { "target": "com.amazonaws.globalaccelerator#Tags", "traits": { - "smithy.api#documentation": "

Create tags for cross-account attachment.

\n

For more information, see Tagging\n\t\t\tin Global Accelerator in the Global Accelerator Developer Guide.

" + "smithy.api#documentation": "

Add tags for a cross-account attachment.

\n

For more information, see Tagging\n\t\t\tin Global Accelerator in the Global Accelerator Developer Guide.

" } } }, @@ -1437,15 +1437,21 @@ "smithy.api#documentation": "

The endpoint ID for the endpoint that is listed in a cross-account attachment and\n\t\t\tcan be added to an accelerator by specified principals.

" } }, + "Cidr": { + "target": "com.amazonaws.globalaccelerator#GenericString", + "traits": { + "smithy.api#documentation": "

An IP address range, in CIDR format, that is specified as an Amazon Web Services resource. The address must\n\t\t\tbe provisioned and advertised in Global Accelerator by following the bring your own IP address (BYOIP) process \n\t\t\tfor Global Accelerator.

\n

For more information, see\n\t\t\tBring your own IP addresses (BYOIP) in \n\t\t\tthe Global Accelerator Developer Guide.

" + } + }, "AttachmentArn": { "target": "com.amazonaws.globalaccelerator#GenericString", "traits": { - "smithy.api#documentation": "

The Amazon Resource Name (ARN) of the cross-account attachment that specifies the endpoints (resources)\n\t\t\tthat can be added to accelerators and principals that have permission to add the endpoints to accelerators.

" + "smithy.api#documentation": "

The Amazon Resource Name (ARN) of the cross-account attachment that specifies the resources (endpoints or\n\t\t\tCIDR range) that can be added to accelerators and principals that have permission to add them.

" } } }, "traits": { - "smithy.api#documentation": "

An endpoint (Amazon Web Services resource) that is listed in a cross-account attachment and\n\t\t\tcan be added to an accelerator by specified principals, that are also listed in the attachment.

" + "smithy.api#documentation": "

An endpoint (Amazon Web Services resource) or an IP address range, in CIDR format, that is \n\t\t\tlisted in a cross-account attachment. A cross-account resource can be added to an accelerator by \n\t\t\tspecified principals, which are also listed in the attachment.

\n

For more information, see \n\t\t\tWorking with cross-account attachments and resources in Global Accelerator in the \n\t\t\t\tGlobal Accelerator Developer Guide.

" } }, "com.amazonaws.globalaccelerator#CrossAccountResources": { @@ -1667,7 +1673,7 @@ "AttachmentArn": { "target": "com.amazonaws.globalaccelerator#GenericString", "traits": { - "smithy.api#documentation": "

The Amazon Resource Name (ARN) of the cross-account attachment that specifies the endpoints (resources)\n\t\t\tthat can be added to accelerators and principals that have permission to add the endpoints to accelerators.

" + "smithy.api#documentation": "

The Amazon Resource Name (ARN) of the cross-account attachment that specifies the endpoints (resources)\n\t\t\tthat can be added to accelerators and principals that have permission to add the endpoints.

" } } }, @@ -1870,7 +1876,7 @@ } ], "traits": { - "smithy.api#documentation": "

Delete a cross-account attachment. When you delete an attachment, Global Accelerator revokes the permission\n\t\t\tto use the resources in the attachment from all principals in the list of principals. Global Accelerator \n\t\t\trevokes the permission for specific resources by doing the following:

\n \n

If there are overlapping permissions provided by multiple cross-account attachments,\n\t\tGlobal Accelerator only removes endpoints if there are no current cross-account attachments that provide\n\t\taccess permission. For example, if you delete a cross-account attachment that lists an\n\t\taccelerator as a principal, but another cross-account attachment includes the account ID\n\t\tthat owns that accelerator, endpoints will not be removed from the accelerator.

" + "smithy.api#documentation": "

Delete a cross-account attachment. When you delete an attachment, Global Accelerator revokes the permission\n\t\t\tto use the resources in the attachment from all principals in the list of principals. Global Accelerator \n\t\t\trevokes the permission for specific resources.

\n

For more information, see \n\t\t\tWorking with cross-account attachments and resources in Global Accelerator in the \n\t\t\t\tGlobal Accelerator Developer Guide.

" } }, "com.amazonaws.globalaccelerator#DeleteCrossAccountAttachmentRequest": { @@ -2188,7 +2194,7 @@ "Cidr": { "target": "com.amazonaws.globalaccelerator#GenericString", "traits": { - "smithy.api#documentation": "

The address range, in CIDR notation. The prefix must be the same prefix that you specified \n\t\t\twhen you provisioned the address range.

", + "smithy.api#documentation": "

The address range, in CIDR notation. The prefix must be the same prefix that you specified \n\t\t\twhen you provisioned the address range.

\n

For more information, see\n\t\t\tBring your own IP addresses (BYOIP) in \n\t\t\tthe Global Accelerator Developer Guide.

", "smithy.api#required": {} } } @@ -2787,7 +2793,7 @@ "EndpointId": { "target": "com.amazonaws.globalaccelerator#GenericString", "traits": { - "smithy.api#documentation": "

An ID for the endpoint. If the endpoint is a Network Load Balancer or Application Load Balancer, this is the Amazon\n\t\t\tResource Name (ARN) of the resource. If the endpoint is an Elastic IP address, this is the Elastic IP address\n\t\t\tallocation ID. For Amazon EC2 instances, this is the EC2 instance ID. A resource must be valid and active \n\t\t\twhen you add it as an endpoint.

\n

An Application Load Balancer can be either internal or internet-facing.

" + "smithy.api#documentation": "

An ID for the endpoint. If the endpoint is a Network Load Balancer or Application Load Balancer, this is the Amazon\n\t\t\tResource Name (ARN) of the resource. If the endpoint is an Elastic IP address, this is the Elastic IP address\n\t\t\tallocation ID. For Amazon EC2 instances, this is the EC2 instance ID. A resource must be valid and active \n\t\t\twhen you add it as an endpoint.

\n

For cross-account endpoints, this must be the ARN of the resource.

" } }, "Weight": { @@ -2805,7 +2811,7 @@ "AttachmentArn": { "target": "com.amazonaws.globalaccelerator#GenericString", "traits": { - "smithy.api#documentation": "

The Amazon Resource Name (ARN) of the cross-account attachment that specifies the endpoints (resources)\n\t\t\tthat can be added to accelerators and principals that have permission to add the endpoints to accelerators.

" + "smithy.api#documentation": "

The Amazon Resource Name (ARN) of the cross-account attachment that specifies the endpoints (resources)\n\t\t\tthat can be added to accelerators and principals that have permission to add the endpoints.

" } } }, @@ -4344,7 +4350,7 @@ } ], "traits": { - "smithy.api#documentation": "

List the accounts that have cross-account endpoints.

" + "smithy.api#documentation": "

List the accounts that have cross-account resources.

\n

For more information, see \n\t\t\tWorking with cross-account attachments and resources in Global Accelerator in the \n\t\t\t\tGlobal Accelerator Developer Guide.

" } }, "com.amazonaws.globalaccelerator#ListCrossAccountResourceAccountsRequest": { @@ -4360,7 +4366,7 @@ "ResourceOwnerAwsAccountIds": { "target": "com.amazonaws.globalaccelerator#AwsAccountIds", "traits": { - "smithy.api#documentation": "

The account IDs of principals (resource owners) in a cross-account attachment who can add endpoints (resources) listed\n\t\t\tin the same attachment.

" + "smithy.api#documentation": "

The account IDs of principals (resource owners) in a cross-account attachment who can work\n\t\t\twith resources listed in the same attachment.

" } } }, @@ -4394,7 +4400,7 @@ } ], "traits": { - "smithy.api#documentation": "

List the cross-account endpoints available to add to an accelerator.

", + "smithy.api#documentation": "

List the cross-account resources available to work with.

", "smithy.api#paginated": { "inputToken": "NextToken", "outputToken": "NextToken", @@ -4422,7 +4428,7 @@ "MaxResults": { "target": "com.amazonaws.globalaccelerator#MaxResults", "traits": { - "smithy.api#documentation": "

The number of cross-account endpoints objects that you want to return with this call. The default value is 10.

" + "smithy.api#documentation": "

The number of cross-account resource objects that you want to return with this call. The default value is 10.

" } }, "NextToken": { @@ -4442,7 +4448,7 @@ "CrossAccountResources": { "target": "com.amazonaws.globalaccelerator#CrossAccountResources", "traits": { - "smithy.api#documentation": "

The endpoints attached to an accelerator in a cross-account attachment.

" + "smithy.api#documentation": "

The cross-account resources used with an accelerator.

" } }, "NextToken": { @@ -5333,7 +5339,7 @@ "Cidr": { "target": "com.amazonaws.globalaccelerator#GenericString", "traits": { - "smithy.api#documentation": "

The public IPv4 address range, in CIDR notation. The most specific IP prefix that you can\n\t\t\tspecify is /24. The address range cannot overlap with another address range that you've brought \n\t\t\tto this or another Region.

", + "smithy.api#documentation": "

The public IPv4 address range, in CIDR notation. The most specific IP prefix that you can\n\t\t\tspecify is /24. The address range cannot overlap with another address range that you've brought \n\t\t\tto this Amazon Web Services Region or another Region.

\n

For more information, see\n\t\t\tBring your own IP addresses (BYOIP) in \n\t\t\tthe Global Accelerator Developer Guide.

", "smithy.api#required": {} } }, @@ -5474,19 +5480,26 @@ "EndpointId": { "target": "com.amazonaws.globalaccelerator#GenericString", "traits": { - "smithy.api#documentation": "

The endpoint ID for the endpoint (Amazon Web Services resource).

", - "smithy.api#required": {} + "smithy.api#addedDefault": {}, + "smithy.api#default": "", + "smithy.api#documentation": "

The endpoint ID for the endpoint that is specified as a Amazon Web Services resource.

\n

An endpoint ID for the cross-account feature is the ARN of an Amazon Web Services resource, such as a \n\t\t\tNetwork Load Balancer, that Global Accelerator supports as an endpoint for an accelerator.

" + } + }, + "Cidr": { + "target": "com.amazonaws.globalaccelerator#GenericString", + "traits": { + "smithy.api#documentation": "

An IP address range, in CIDR format, that is specified as resource. The address must\n\t\t\tbe provisioned and advertised in Global Accelerator by following the bring your own IP address (BYOIP) process \n\t\t\tfor Global Accelerator

\n

For more information, see\n\t\t\tBring your own IP addresses (BYOIP) in \n\t\t\tthe Global Accelerator Developer Guide.

" } }, "Region": { "target": "com.amazonaws.globalaccelerator#GenericString", "traits": { - "smithy.api#documentation": "

The Amazon Web Services Region where a resource is located.

" + "smithy.api#documentation": "

The Amazon Web Services Region where a shared endpoint resource is located.

" } } }, "traits": { - "smithy.api#documentation": "

An Amazon Web Services resource that is supported by Global Accelerator and can be added as an endpoint for an accelerator.

" + "smithy.api#documentation": "

A resource is one of the following: the ARN for an Amazon Web Services resource that is supported by \n\t\t\tGlobal Accelerator to be added as an endpoint, or a CIDR range that specifies a bring your own IP (BYOIP) address pool.

" } }, "com.amazonaws.globalaccelerator#ResourceArn": { @@ -5901,7 +5914,7 @@ } ], "traits": { - "smithy.api#documentation": "

Update a cross-account attachment to add or remove principals or resources. When you update \n\t\t\tan attachment to remove a principal (account ID or accelerator) or a resource, Global Accelerator \n\t\t\trevokes the permission for specific resources by doing the following:

\n \n

If there are overlapping permissions provided by multiple cross-account attachments,\n\t\t\tGlobal Accelerator only removes endpoints if there are no current cross-account attachments that provide\n\t\t\taccess permission. For example, if you delete a cross-account attachment that lists an\n\t\t\taccelerator as a principal, but another cross-account attachment includes the account ID\n\t\t\tthat owns that accelerator, endpoints will not be removed from the accelerator.

" + "smithy.api#documentation": "

Update a cross-account attachment to add or remove principals or resources. When you update \n\t\t\tan attachment to remove a principal (account ID or accelerator) or a resource, Global Accelerator \n\t\t\trevokes the permission for specific resources.

\n

For more information, see \n\t\t\tWorking with cross-account attachments and resources in Global Accelerator in the \n\t\t\t\tGlobal Accelerator Developer Guide.

" } }, "com.amazonaws.globalaccelerator#UpdateCrossAccountAttachmentRequest": { @@ -5923,25 +5936,25 @@ "AddPrincipals": { "target": "com.amazonaws.globalaccelerator#Principals", "traits": { - "smithy.api#documentation": "

The principals to add to the cross-account attachment. A principal is an account or the Amazon Resource Name (ARN)\n\t\t\tof an accelerator that the attachment gives permission to add the resources from another account, listed in the attachment.

\n

To add more than one principal, separate the account numbers or accelerator ARNs, or both, with commas.

" + "smithy.api#documentation": "

The principals to add to the cross-account attachment. A principal is an account or the Amazon Resource Name (ARN)\n\t\t\tof an accelerator that the attachment gives permission to work with resources from another account. The resources\n\t\t\tare also listed in the attachment.

\n

To add more than one principal, separate the account numbers or accelerator ARNs, or both, with commas.

" } }, "RemovePrincipals": { "target": "com.amazonaws.globalaccelerator#Principals", "traits": { - "smithy.api#documentation": "

The principals to remove from the cross-account attachment. A principal is an account or the Amazon Resource Name (ARN)\n\t\t\tof an accelerator that is given permission to add the resources from another account, listed in the cross-account attachment.

\n

To remove more than one principal, separate the account numbers or accelerator ARNs, or both, with commas.

" + "smithy.api#documentation": "

The principals to remove from the cross-account attachment. A principal is an account or the Amazon Resource Name (ARN)\n\t\t\tof an accelerator that the attachment gives permission to work with resources from another account. The resources\n\t\t\tare also listed in the attachment.

\n

To remove more than one principal, separate the account numbers or accelerator ARNs, or both, with commas.

" } }, "AddResources": { "target": "com.amazonaws.globalaccelerator#Resources", "traits": { - "smithy.api#documentation": "

The resources to add to the cross-account attachment. A resource listed in a cross-account attachment can be added\n\t\t\tto an accelerator by the principals that are listed in the attachment.

\n

To add more than one resource, separate the resource ARNs with commas.

" + "smithy.api#documentation": "

The resources to add to the cross-account attachment. A resource listed in a cross-account attachment can be used\n\t\t\twith an accelerator by the principals that are listed in the attachment.

\n

To add more than one resource, separate the resource ARNs with commas.

" } }, "RemoveResources": { "target": "com.amazonaws.globalaccelerator#Resources", "traits": { - "smithy.api#documentation": "

The resources to remove from the cross-account attachment. A resource listed in a cross-account attachment can be added\n\t\t\tto an accelerator fy principals that are listed in the cross-account attachment.

\n

To remove more than one resource, separate the resource ARNs with commas.

" + "smithy.api#documentation": "

The resources to remove from the cross-account attachment. A resource listed in a cross-account attachment can be used\n\t\t\twith an accelerator by the principals that are listed in the attachment.

\n

To remove more than one resource, separate the resource ARNs with commas.

" } } }, @@ -6388,7 +6401,7 @@ "Cidr": { "target": "com.amazonaws.globalaccelerator#GenericString", "traits": { - "smithy.api#documentation": "

The address range, in CIDR notation.

", + "smithy.api#documentation": "

The address range, in CIDR notation.

\n

For more information, see\n\t\t\tBring your own IP addresses (BYOIP) in \n\t\t\tthe Global Accelerator Developer Guide.

", "smithy.api#required": {} } } @@ -6403,7 +6416,7 @@ "ByoipCidr": { "target": "com.amazonaws.globalaccelerator#ByoipCidr", "traits": { - "smithy.api#documentation": "

Information about the address pool.

" + "smithy.api#documentation": "

Information about the BYOIP address pool.

" } } },