diff --git a/.changelog/6570c55a771f44a882a0c3e6f2b8d64f.json b/.changelog/6570c55a771f44a882a0c3e6f2b8d64f.json
new file mode 100644
index 00000000000..4d06623d9d4
--- /dev/null
+++ b/.changelog/6570c55a771f44a882a0c3e6f2b8d64f.json
@@ -0,0 +1,8 @@
+{
+    "id": "6570c55a-771f-44a8-82a0-c3e6f2b8d64f",
+    "type": "feature",
+    "description": "Adds support to 2 new filters about job complete time for 3 list jobs APIs in AWS Backup",
+    "modules": [
+        "service/backup"
+    ]
+}
\ No newline at end of file
diff --git a/.changelog/6dc1e20484f74174a92799f8557b4150.json b/.changelog/6dc1e20484f74174a92799f8557b4150.json
new file mode 100644
index 00000000000..b1c4454709c
--- /dev/null
+++ b/.changelog/6dc1e20484f74174a92799f8557b4150.json
@@ -0,0 +1,8 @@
+{
+    "id": "6dc1e204-84f7-4174-a927-99f8557b4150",
+    "type": "feature",
+    "description": "This release introduces a new API RotateTunnelAccessToken that allow revoking the existing tokens and generate new tokens",
+    "modules": [
+        "service/iotsecuretunneling"
+    ]
+}
\ No newline at end of file
diff --git a/.changelog/b0ea12ff9bfd4f9096b83ffff5175b53.json b/.changelog/b0ea12ff9bfd4f9096b83ffff5175b53.json
new file mode 100644
index 00000000000..0e7e4761603
--- /dev/null
+++ b/.changelog/b0ea12ff9bfd4f9096b83ffff5175b53.json
@@ -0,0 +1,8 @@
+{
+    "id": "b0ea12ff-9bfd-4f90-96b8-3ffff5175b53",
+    "type": "documentation",
+    "description": "Documentation updates for Lightsail",
+    "modules": [
+        "service/lightsail"
+    ]
+}
\ No newline at end of file
diff --git a/.changelog/db9c3ea0d29f4daca83828e12b71a795.json b/.changelog/db9c3ea0d29f4daca83828e12b71a795.json
new file mode 100644
index 00000000000..29ba74c385e
--- /dev/null
+++ b/.changelog/db9c3ea0d29f4daca83828e12b71a795.json
@@ -0,0 +1,8 @@
+{
+    "id": "db9c3ea0-d29f-4dac-a838-28e12b71a795",
+    "type": "feature",
+    "description": "This release adds the TargetMaps parameter in SSM State Manager API.",
+    "modules": [
+        "service/ssm"
+    ]
+}
\ No newline at end of file
diff --git a/service/appmesh/internal/endpoints/endpoints.go b/service/appmesh/internal/endpoints/endpoints.go
index 1f216fe060d..ec60f4d3a41 100644
--- a/service/appmesh/internal/endpoints/endpoints.go
+++ b/service/appmesh/internal/endpoints/endpoints.go
@@ -138,63 +138,183 @@ var defaultPartitions = endpoints.Partitions{
 			endpoints.EndpointKey{
 				Region: "af-south-1",
 			}: endpoints.Endpoint{},
+			endpoints.EndpointKey{
+				Region:  "af-south-1",
+				Variant: endpoints.DualStackVariant,
+			}: {
+				Hostname: "appmesh.af-south-1.api.aws",
+			},
 			endpoints.EndpointKey{
 				Region: "ap-east-1",
 			}: endpoints.Endpoint{},
+			endpoints.EndpointKey{
+				Region:  "ap-east-1",
+				Variant: endpoints.DualStackVariant,
+			}: {
+				Hostname: "appmesh.ap-east-1.api.aws",
+			},
 			endpoints.EndpointKey{
 				Region: "ap-northeast-1",
 			}: endpoints.Endpoint{},
+			endpoints.EndpointKey{
+				Region:  "ap-northeast-1",
+				Variant: endpoints.DualStackVariant,
+			}: {
+				Hostname: "appmesh.ap-northeast-1.api.aws",
+			},
 			endpoints.EndpointKey{
 				Region: "ap-northeast-2",
 			}: endpoints.Endpoint{},
+			endpoints.EndpointKey{
+				Region:  "ap-northeast-2",
+				Variant: endpoints.DualStackVariant,
+			}: {
+				Hostname: "appmesh.ap-northeast-2.api.aws",
+			},
 			endpoints.EndpointKey{
 				Region: "ap-south-1",
 			}: endpoints.Endpoint{},
+			endpoints.EndpointKey{
+				Region:  "ap-south-1",
+				Variant: endpoints.DualStackVariant,
+			}: {
+				Hostname: "appmesh.ap-south-1.api.aws",
+			},
 			endpoints.EndpointKey{
 				Region: "ap-southeast-1",
 			}: endpoints.Endpoint{},
+			endpoints.EndpointKey{
+				Region:  "ap-southeast-1",
+				Variant: endpoints.DualStackVariant,
+			}: {
+				Hostname: "appmesh.ap-southeast-1.api.aws",
+			},
 			endpoints.EndpointKey{
 				Region: "ap-southeast-2",
 			}: endpoints.Endpoint{},
+			endpoints.EndpointKey{
+				Region:  "ap-southeast-2",
+				Variant: endpoints.DualStackVariant,
+			}: {
+				Hostname: "appmesh.ap-southeast-2.api.aws",
+			},
 			endpoints.EndpointKey{
 				Region: "ca-central-1",
 			}: endpoints.Endpoint{},
+			endpoints.EndpointKey{
+				Region:  "ca-central-1",
+				Variant: endpoints.DualStackVariant,
+			}: {
+				Hostname: "appmesh.ca-central-1.api.aws",
+			},
 			endpoints.EndpointKey{
 				Region: "eu-central-1",
 			}: endpoints.Endpoint{},
+			endpoints.EndpointKey{
+				Region:  "eu-central-1",
+				Variant: endpoints.DualStackVariant,
+			}: {
+				Hostname: "appmesh.eu-central-1.api.aws",
+			},
 			endpoints.EndpointKey{
 				Region: "eu-north-1",
 			}: endpoints.Endpoint{},
+			endpoints.EndpointKey{
+				Region:  "eu-north-1",
+				Variant: endpoints.DualStackVariant,
+			}: {
+				Hostname: "appmesh.eu-north-1.api.aws",
+			},
 			endpoints.EndpointKey{
 				Region: "eu-south-1",
 			}: endpoints.Endpoint{},
+			endpoints.EndpointKey{
+				Region:  "eu-south-1",
+				Variant: endpoints.DualStackVariant,
+			}: {
+				Hostname: "appmesh.eu-south-1.api.aws",
+			},
 			endpoints.EndpointKey{
 				Region: "eu-west-1",
 			}: endpoints.Endpoint{},
+			endpoints.EndpointKey{
+				Region:  "eu-west-1",
+				Variant: endpoints.DualStackVariant,
+			}: {
+				Hostname: "appmesh.eu-west-1.api.aws",
+			},
 			endpoints.EndpointKey{
 				Region: "eu-west-2",
 			}: endpoints.Endpoint{},
+			endpoints.EndpointKey{
+				Region:  "eu-west-2",
+				Variant: endpoints.DualStackVariant,
+			}: {
+				Hostname: "appmesh.eu-west-2.api.aws",
+			},
 			endpoints.EndpointKey{
 				Region: "eu-west-3",
 			}: endpoints.Endpoint{},
+			endpoints.EndpointKey{
+				Region:  "eu-west-3",
+				Variant: endpoints.DualStackVariant,
+			}: {
+				Hostname: "appmesh.eu-west-3.api.aws",
+			},
 			endpoints.EndpointKey{
 				Region: "me-south-1",
 			}: endpoints.Endpoint{},
+			endpoints.EndpointKey{
+				Region:  "me-south-1",
+				Variant: endpoints.DualStackVariant,
+			}: {
+				Hostname: "appmesh.me-south-1.api.aws",
+			},
 			endpoints.EndpointKey{
 				Region: "sa-east-1",
 			}: endpoints.Endpoint{},
+			endpoints.EndpointKey{
+				Region:  "sa-east-1",
+				Variant: endpoints.DualStackVariant,
+			}: {
+				Hostname: "appmesh.sa-east-1.api.aws",
+			},
 			endpoints.EndpointKey{
 				Region: "us-east-1",
 			}: endpoints.Endpoint{},
+			endpoints.EndpointKey{
+				Region:  "us-east-1",
+				Variant: endpoints.DualStackVariant,
+			}: {
+				Hostname: "appmesh.us-east-1.api.aws",
+			},
 			endpoints.EndpointKey{
 				Region: "us-east-2",
 			}: endpoints.Endpoint{},
+			endpoints.EndpointKey{
+				Region:  "us-east-2",
+				Variant: endpoints.DualStackVariant,
+			}: {
+				Hostname: "appmesh.us-east-2.api.aws",
+			},
 			endpoints.EndpointKey{
 				Region: "us-west-1",
 			}: endpoints.Endpoint{},
+			endpoints.EndpointKey{
+				Region:  "us-west-1",
+				Variant: endpoints.DualStackVariant,
+			}: {
+				Hostname: "appmesh.us-west-1.api.aws",
+			},
 			endpoints.EndpointKey{
 				Region: "us-west-2",
 			}: endpoints.Endpoint{},
+			endpoints.EndpointKey{
+				Region:  "us-west-2",
+				Variant: endpoints.DualStackVariant,
+			}: {
+				Hostname: "appmesh.us-west-2.api.aws",
+			},
 		},
 	},
 	{
@@ -235,9 +355,21 @@ var defaultPartitions = endpoints.Partitions{
 			endpoints.EndpointKey{
 				Region: "cn-north-1",
 			}: endpoints.Endpoint{},
+			endpoints.EndpointKey{
+				Region:  "cn-north-1",
+				Variant: endpoints.DualStackVariant,
+			}: {
+				Hostname: "appmesh.cn-north-1.api.amazonwebservices.com.cn",
+			},
 			endpoints.EndpointKey{
 				Region: "cn-northwest-1",
 			}: endpoints.Endpoint{},
+			endpoints.EndpointKey{
+				Region:  "cn-northwest-1",
+				Variant: endpoints.DualStackVariant,
+			}: {
+				Hostname: "appmesh.cn-northwest-1.api.amazonwebservices.com.cn",
+			},
 		},
 	},
 	{
diff --git a/service/backup/api_op_ListBackupJobs.go b/service/backup/api_op_ListBackupJobs.go
index 6eaa5f1a038..751e2b8c864 100644
--- a/service/backup/api_op_ListBackupJobs.go
+++ b/service/backup/api_op_ListBackupJobs.go
@@ -44,6 +44,14 @@ type ListBackupJobsInput struct {
 	// consist of lowercase letters, numbers, and hyphens.
 	ByBackupVaultName *string
 
+	// Returns only backup jobs completed after a date expressed in Unix format and
+	// Coordinated Universal Time (UTC).
+	ByCompleteAfter *time.Time
+
+	// Returns only backup jobs completed before a date expressed in Unix format and
+	// Coordinated Universal Time (UTC).
+	ByCompleteBefore *time.Time
+
 	// Returns only backup jobs that were created after the specified date.
 	ByCreatedAfter *time.Time
 
diff --git a/service/backup/api_op_ListCopyJobs.go b/service/backup/api_op_ListCopyJobs.go
index 41925984b51..74fadb4e6c0 100644
--- a/service/backup/api_op_ListCopyJobs.go
+++ b/service/backup/api_op_ListCopyJobs.go
@@ -35,6 +35,14 @@ type ListCopyJobsInput struct {
 	// specified account ID.
 	ByAccountId *string
 
+	// Returns only copy jobs completed after a date expressed in Unix format and
+	// Coordinated Universal Time (UTC).
+	ByCompleteAfter *time.Time
+
+	// Returns only copy jobs completed before a date expressed in Unix format and
+	// Coordinated Universal Time (UTC).
+	ByCompleteBefore *time.Time
+
 	// Returns only copy jobs that were created after the specified date.
 	ByCreatedAfter *time.Time
 
diff --git a/service/backup/api_op_ListRestoreJobs.go b/service/backup/api_op_ListRestoreJobs.go
index 46f28d65e1d..159228fe519 100644
--- a/service/backup/api_op_ListRestoreJobs.go
+++ b/service/backup/api_op_ListRestoreJobs.go
@@ -36,6 +36,14 @@ type ListRestoreJobsInput struct {
 	// the specified account ID.
 	ByAccountId *string
 
+	// Returns only copy jobs completed after a date expressed in Unix format and
+	// Coordinated Universal Time (UTC).
+	ByCompleteAfter *time.Time
+
+	// Returns only copy jobs completed before a date expressed in Unix format and
+	// Coordinated Universal Time (UTC).
+	ByCompleteBefore *time.Time
+
 	// Returns only restore jobs that were created after the specified date.
 	ByCreatedAfter *time.Time
 
diff --git a/service/backup/serializers.go b/service/backup/serializers.go
index b11dfdbc17c..e57711a1c79 100644
--- a/service/backup/serializers.go
+++ b/service/backup/serializers.go
@@ -2292,6 +2292,14 @@ func awsRestjson1_serializeOpHttpBindingsListBackupJobsInput(v *ListBackupJobsIn
 		encoder.SetQuery("backupVaultName").String(*v.ByBackupVaultName)
 	}
 
+	if v.ByCompleteAfter != nil {
+		encoder.SetQuery("completeAfter").String(smithytime.FormatDateTime(*v.ByCompleteAfter))
+	}
+
+	if v.ByCompleteBefore != nil {
+		encoder.SetQuery("completeBefore").String(smithytime.FormatDateTime(*v.ByCompleteBefore))
+	}
+
 	if v.ByCreatedAfter != nil {
 		encoder.SetQuery("createdAfter").String(smithytime.FormatDateTime(*v.ByCreatedAfter))
 	}
@@ -2680,6 +2688,14 @@ func awsRestjson1_serializeOpHttpBindingsListCopyJobsInput(v *ListCopyJobsInput,
 		encoder.SetQuery("accountId").String(*v.ByAccountId)
 	}
 
+	if v.ByCompleteAfter != nil {
+		encoder.SetQuery("completeAfter").String(smithytime.FormatDateTime(*v.ByCompleteAfter))
+	}
+
+	if v.ByCompleteBefore != nil {
+		encoder.SetQuery("completeBefore").String(smithytime.FormatDateTime(*v.ByCompleteBefore))
+	}
+
 	if v.ByCreatedAfter != nil {
 		encoder.SetQuery("createdAfter").String(smithytime.FormatDateTime(*v.ByCreatedAfter))
 	}
@@ -3161,6 +3177,14 @@ func awsRestjson1_serializeOpHttpBindingsListRestoreJobsInput(v *ListRestoreJobs
 		encoder.SetQuery("accountId").String(*v.ByAccountId)
 	}
 
+	if v.ByCompleteAfter != nil {
+		encoder.SetQuery("completeAfter").String(smithytime.FormatDateTime(*v.ByCompleteAfter))
+	}
+
+	if v.ByCompleteBefore != nil {
+		encoder.SetQuery("completeBefore").String(smithytime.FormatDateTime(*v.ByCompleteBefore))
+	}
+
 	if v.ByCreatedAfter != nil {
 		encoder.SetQuery("createdAfter").String(smithytime.FormatDateTime(*v.ByCreatedAfter))
 	}
diff --git a/service/iotsecuretunneling/api_op_CloseTunnel.go b/service/iotsecuretunneling/api_op_CloseTunnel.go
index e445ad8a50e..f622c64a4e4 100644
--- a/service/iotsecuretunneling/api_op_CloseTunnel.go
+++ b/service/iotsecuretunneling/api_op_CloseTunnel.go
@@ -12,7 +12,10 @@ import (
 
 // Closes a tunnel identified by the unique tunnel id. When a CloseTunnel request
 // is received, we close the WebSocket connections between the client and proxy
-// server so no data can be transmitted.
+// server so no data can be transmitted. Requires permission to access the
+// CloseTunnel
+// (https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html#awsiot-actions-as-permissions)
+// action.
 func (c *Client) CloseTunnel(ctx context.Context, params *CloseTunnelInput, optFns ...func(*Options)) (*CloseTunnelOutput, error) {
 	if params == nil {
 		params = &CloseTunnelInput{}
@@ -35,7 +38,7 @@ type CloseTunnelInput struct {
 	// This member is required.
 	TunnelId *string
 
-	// When set to true, AWS IoT Secure Tunneling deletes the tunnel data immediately.
+	// When set to true, IoT Secure Tunneling deletes the tunnel data immediately.
 	Delete bool
 
 	noSmithyDocumentSerde
diff --git a/service/iotsecuretunneling/api_op_DescribeTunnel.go b/service/iotsecuretunneling/api_op_DescribeTunnel.go
index cf754f9345f..898d133e8e9 100644
--- a/service/iotsecuretunneling/api_op_DescribeTunnel.go
+++ b/service/iotsecuretunneling/api_op_DescribeTunnel.go
@@ -11,7 +11,10 @@ import (
 	smithyhttp "github.com/aws/smithy-go/transport/http"
 )
 
-// Gets information about a tunnel identified by the unique tunnel id.
+// Gets information about a tunnel identified by the unique tunnel id. Requires
+// permission to access the DescribeTunnel
+// (https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html#awsiot-actions-as-permissions)
+// action.
 func (c *Client) DescribeTunnel(ctx context.Context, params *DescribeTunnelInput, optFns ...func(*Options)) (*DescribeTunnelOutput, error) {
 	if params == nil {
 		params = &DescribeTunnelInput{}
diff --git a/service/iotsecuretunneling/api_op_ListTunnels.go b/service/iotsecuretunneling/api_op_ListTunnels.go
index d8c4eb01748..1a333f1f3e6 100644
--- a/service/iotsecuretunneling/api_op_ListTunnels.go
+++ b/service/iotsecuretunneling/api_op_ListTunnels.go
@@ -12,8 +12,11 @@ import (
 	smithyhttp "github.com/aws/smithy-go/transport/http"
 )
 
-// List all tunnels for an AWS account. Tunnels are listed by creation time in
-// descending order, newer tunnels will be listed before older tunnels.
+// List all tunnels for an Amazon Web Services account. Tunnels are listed by
+// creation time in descending order, newer tunnels will be listed before older
+// tunnels. Requires permission to access the ListTunnels
+// (https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html#awsiot-actions-as-permissions)
+// action.
 func (c *Client) ListTunnels(ctx context.Context, params *ListTunnelsInput, optFns ...func(*Options)) (*ListTunnelsOutput, error) {
 	if params == nil {
 		params = &ListTunnelsInput{}
@@ -34,7 +37,8 @@ type ListTunnelsInput struct {
 	// The maximum number of results to return at once.
 	MaxResults int32
 
-	// A token to retrieve the next set of results.
+	// To retrieve the next set of results, the nextToken value from a previous
+	// response; otherwise null to receive the first set of results.
 	NextToken *string
 
 	// The name of the IoT thing associated with the destination device.
@@ -45,10 +49,11 @@ type ListTunnelsInput struct {
 
 type ListTunnelsOutput struct {
 
-	// A token to used to retrieve the next set of results.
+	// The token to use to get the next set of results, or null if there are no
+	// additional results.
 	NextToken *string
 
-	// A short description of the tunnels in an AWS account.
+	// A short description of the tunnels in an Amazon Web Services account.
 	TunnelSummaries []types.TunnelSummary
 
 	// Metadata pertaining to the operation's result.
diff --git a/service/iotsecuretunneling/api_op_OpenTunnel.go b/service/iotsecuretunneling/api_op_OpenTunnel.go
index 7daa7ee282e..4a61467bb5b 100644
--- a/service/iotsecuretunneling/api_op_OpenTunnel.go
+++ b/service/iotsecuretunneling/api_op_OpenTunnel.go
@@ -12,7 +12,10 @@ import (
 )
 
 // Creates a new tunnel, and returns two client access tokens for clients to use to
-// connect to the AWS IoT Secure Tunneling proxy server.
+// connect to the IoT Secure Tunneling proxy server. Requires permission to access
+// the OpenTunnel
+// (https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html#awsiot-actions-as-permissions)
+// action.
 func (c *Client) OpenTunnel(ctx context.Context, params *OpenTunnelInput, optFns ...func(*Options)) (*OpenTunnelOutput, error) {
 	if params == nil {
 		params = &OpenTunnelInput{}
@@ -47,16 +50,14 @@ type OpenTunnelInput struct {
 
 type OpenTunnelOutput struct {
 
-	// The access token the destination local proxy uses to connect to AWS IoT Secure
+	// The access token the destination local proxy uses to connect to IoT Secure
 	// Tunneling.
 	DestinationAccessToken *string
 
-	// The access token the source local proxy uses to connect to AWS IoT Secure
-	// Tunneling.
+	// The access token the source local proxy uses to connect to IoT Secure Tunneling.
 	SourceAccessToken *string
 
-	// The Amazon Resource Name for the tunnel. The tunnel ARN format is
-	// arn:aws:tunnel:::tunnel/
+	// The Amazon Resource Name for the tunnel.
 	TunnelArn *string
 
 	// A unique alpha-numeric tunnel ID.
diff --git a/service/iotsecuretunneling/api_op_RotateTunnelAccessToken.go b/service/iotsecuretunneling/api_op_RotateTunnelAccessToken.go
new file mode 100644
index 00000000000..5b456909747
--- /dev/null
+++ b/service/iotsecuretunneling/api_op_RotateTunnelAccessToken.go
@@ -0,0 +1,145 @@
+// Code generated by smithy-go-codegen DO NOT EDIT.
+
+package iotsecuretunneling
+
+import (
+	"context"
+	awsmiddleware "github.com/aws/aws-sdk-go-v2/aws/middleware"
+	"github.com/aws/aws-sdk-go-v2/aws/signer/v4"
+	"github.com/aws/aws-sdk-go-v2/service/iotsecuretunneling/types"
+	"github.com/aws/smithy-go/middleware"
+	smithyhttp "github.com/aws/smithy-go/transport/http"
+)
+
+// Revokes the current client access token (CAT) and returns new CAT for clients to
+// use when reconnecting to secure tunneling to access the same tunnel. Requires
+// permission to access the RotateTunnelAccessToken
+// (https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html#awsiot-actions-as-permissions)
+// action. Rotating the CAT doesn't extend the tunnel duration. For example, say
+// the tunnel duration is 12 hours and the tunnel has already been open for 4
+// hours. When you rotate the access tokens, the new tokens that are generated can
+// only be used for the remaining 8 hours.
+func (c *Client) RotateTunnelAccessToken(ctx context.Context, params *RotateTunnelAccessTokenInput, optFns ...func(*Options)) (*RotateTunnelAccessTokenOutput, error) {
+	if params == nil {
+		params = &RotateTunnelAccessTokenInput{}
+	}
+
+	result, metadata, err := c.invokeOperation(ctx, "RotateTunnelAccessToken", params, optFns, c.addOperationRotateTunnelAccessTokenMiddlewares)
+	if err != nil {
+		return nil, err
+	}
+
+	out := result.(*RotateTunnelAccessTokenOutput)
+	out.ResultMetadata = metadata
+	return out, nil
+}
+
+type RotateTunnelAccessTokenInput struct {
+
+	// The mode of the client that will use the client token, which can be either the
+	// source or destination, or both source and destination.
+	//
+	// This member is required.
+	ClientMode types.ClientMode
+
+	// The tunnel for which you want to rotate the access tokens.
+	//
+	// This member is required.
+	TunnelId *string
+
+	// The destination configuration.
+	DestinationConfig *types.DestinationConfig
+
+	noSmithyDocumentSerde
+}
+
+type RotateTunnelAccessTokenOutput struct {
+
+	// The client access token that the destination local proxy uses to connect to IoT
+	// Secure Tunneling.
+	DestinationAccessToken *string
+
+	// The client access token that the source local proxy uses to connect to IoT
+	// Secure Tunneling.
+	SourceAccessToken *string
+
+	// The Amazon Resource Name for the tunnel.
+	TunnelArn *string
+
+	// Metadata pertaining to the operation's result.
+	ResultMetadata middleware.Metadata
+
+	noSmithyDocumentSerde
+}
+
+func (c *Client) addOperationRotateTunnelAccessTokenMiddlewares(stack *middleware.Stack, options Options) (err error) {
+	err = stack.Serialize.Add(&awsAwsjson11_serializeOpRotateTunnelAccessToken{}, middleware.After)
+	if err != nil {
+		return err
+	}
+	err = stack.Deserialize.Add(&awsAwsjson11_deserializeOpRotateTunnelAccessToken{}, middleware.After)
+	if err != nil {
+		return err
+	}
+	if err = addSetLoggerMiddleware(stack, options); err != nil {
+		return err
+	}
+	if err = awsmiddleware.AddClientRequestIDMiddleware(stack); err != nil {
+		return err
+	}
+	if err = smithyhttp.AddComputeContentLengthMiddleware(stack); err != nil {
+		return err
+	}
+	if err = addResolveEndpointMiddleware(stack, options); err != nil {
+		return err
+	}
+	if err = v4.AddComputePayloadSHA256Middleware(stack); err != nil {
+		return err
+	}
+	if err = addRetryMiddlewares(stack, options); err != nil {
+		return err
+	}
+	if err = addHTTPSignerV4Middleware(stack, options); err != nil {
+		return err
+	}
+	if err = awsmiddleware.AddRawResponseToMetadata(stack); err != nil {
+		return err
+	}
+	if err = awsmiddleware.AddRecordResponseTiming(stack); err != nil {
+		return err
+	}
+	if err = addClientUserAgent(stack); err != nil {
+		return err
+	}
+	if err = smithyhttp.AddErrorCloseResponseBodyMiddleware(stack); err != nil {
+		return err
+	}
+	if err = smithyhttp.AddCloseResponseBodyMiddleware(stack); err != nil {
+		return err
+	}
+	if err = addOpRotateTunnelAccessTokenValidationMiddleware(stack); err != nil {
+		return err
+	}
+	if err = stack.Initialize.Add(newServiceMetadataMiddleware_opRotateTunnelAccessToken(options.Region), middleware.Before); err != nil {
+		return err
+	}
+	if err = addRequestIDRetrieverMiddleware(stack); err != nil {
+		return err
+	}
+	if err = addResponseErrorMiddleware(stack); err != nil {
+		return err
+	}
+	if err = addRequestResponseLogging(stack, options); err != nil {
+		return err
+	}
+	return nil
+}
+
+func newServiceMetadataMiddleware_opRotateTunnelAccessToken(region string) *awsmiddleware.RegisterServiceMetadata {
+	return &awsmiddleware.RegisterServiceMetadata{
+		Region:        region,
+		ServiceID:     ServiceID,
+		SigningName:   "iotsecuredtunneling",
+		OperationName: "RotateTunnelAccessToken",
+	}
+}
diff --git a/service/iotsecuretunneling/deserializers.go b/service/iotsecuretunneling/deserializers.go
index de45259d212..a23b2805c52 100644
--- a/service/iotsecuretunneling/deserializers.go
+++ b/service/iotsecuretunneling/deserializers.go
@@ -571,6 +571,117 @@ func awsAwsjson11_deserializeOpErrorOpenTunnel(response *smithyhttp.Response, me
 	}
 }
 
+type awsAwsjson11_deserializeOpRotateTunnelAccessToken struct {
+}
+
+func (*awsAwsjson11_deserializeOpRotateTunnelAccessToken) ID() string {
+	return "OperationDeserializer"
+}
+
+func (m *awsAwsjson11_deserializeOpRotateTunnelAccessToken) HandleDeserialize(ctx context.Context, in middleware.DeserializeInput, next middleware.DeserializeHandler) (
+	out middleware.DeserializeOutput, metadata middleware.Metadata, err error,
+) {
+	out, metadata, err = next.HandleDeserialize(ctx, in)
+	if err != nil {
+		return out, metadata, err
+	}
+
+	response, ok := out.RawResponse.(*smithyhttp.Response)
+	if !ok {
+		return out, metadata, &smithy.DeserializationError{Err: fmt.Errorf("unknown transport type %T", out.RawResponse)}
+	}
+
+	if response.StatusCode < 200 || response.StatusCode >= 300 {
+		return out, metadata, awsAwsjson11_deserializeOpErrorRotateTunnelAccessToken(response, &metadata)
+	}
+	output := &RotateTunnelAccessTokenOutput{}
+	out.Result = output
+
+	var buff [1024]byte
+	ringBuffer := smithyio.NewRingBuffer(buff[:])
+
+	body := io.TeeReader(response.Body, ringBuffer)
+	decoder := json.NewDecoder(body)
+	decoder.UseNumber()
+	var shape interface{}
+	if err := decoder.Decode(&shape); err != nil && err != io.EOF {
+		var snapshot bytes.Buffer
+		io.Copy(&snapshot, ringBuffer)
+		err = &smithy.DeserializationError{
+			Err:      fmt.Errorf("failed to decode response body, %w", err),
+			Snapshot: snapshot.Bytes(),
+		}
+		return out, metadata, err
+	}
+
+	err = awsAwsjson11_deserializeOpDocumentRotateTunnelAccessTokenOutput(&output, shape)
+	if err != nil {
+		var snapshot bytes.Buffer
+		io.Copy(&snapshot, ringBuffer)
+		err = &smithy.DeserializationError{
+			Err:      fmt.Errorf("failed to decode response body, %w", err),
+			Snapshot: snapshot.Bytes(),
+		}
+		return out, metadata, err
+	}
+
+	return out, metadata, err
+}
+
+func awsAwsjson11_deserializeOpErrorRotateTunnelAccessToken(response *smithyhttp.Response, metadata *middleware.Metadata) error {
+	var errorBuffer bytes.Buffer
+	if _, err := io.Copy(&errorBuffer, response.Body); err != nil {
+		return &smithy.DeserializationError{Err: fmt.Errorf("failed to copy error response body, %w", err)}
+	}
+	errorBody := bytes.NewReader(errorBuffer.Bytes())
+
+	errorCode := "UnknownError"
+	errorMessage := errorCode
+
+	code := response.Header.Get("X-Amzn-ErrorType")
+	if len(code) != 0 {
+		errorCode = restjson.SanitizeErrorCode(code)
+	}
+
+	var buff [1024]byte
+	ringBuffer := smithyio.NewRingBuffer(buff[:])
+
+	body := io.TeeReader(errorBody, ringBuffer)
+	decoder := json.NewDecoder(body)
+	decoder.UseNumber()
+	code, message, err := restjson.GetErrorInfo(decoder)
+	if err != nil {
+		var snapshot bytes.Buffer
+		io.Copy(&snapshot, ringBuffer)
+		err = &smithy.DeserializationError{
+			Err:      fmt.Errorf("failed to decode response body, %w", err),
+			Snapshot: snapshot.Bytes(),
+		}
+		return err
+	}
+
+	errorBody.Seek(0, io.SeekStart)
+	if len(code) != 0 {
+		errorCode = restjson.SanitizeErrorCode(code)
+	}
+	if len(message) != 0 {
+		errorMessage = message
+	}
+
+	switch {
+	case strings.EqualFold("ResourceNotFoundException", errorCode):
+		return awsAwsjson11_deserializeErrorResourceNotFoundException(response, errorBody)
+
+	default:
+		genericError := &smithy.GenericAPIError{
+			Code:    errorCode,
+			Message: errorMessage,
+		}
+		return genericError
+
+	}
+}
+
 type awsAwsjson11_deserializeOpTagResource struct {
 }
 
@@ -1679,6 +1790,64 @@ func awsAwsjson11_deserializeOpDocumentOpenTunnelOutput(v **OpenTunnelOutput, va
 	return nil
 }
 
+func awsAwsjson11_deserializeOpDocumentRotateTunnelAccessTokenOutput(v **RotateTunnelAccessTokenOutput, value interface{}) error {
+	if v == nil {
+		return fmt.Errorf("unexpected nil of type %T", v)
+	}
+	if value == nil {
+		return nil
+	}
+
+	shape, ok := value.(map[string]interface{})
+	if !ok {
+		return fmt.Errorf("unexpected JSON type %v", value)
+	}
+
+	var sv *RotateTunnelAccessTokenOutput
+	if *v == nil {
+		sv = &RotateTunnelAccessTokenOutput{}
+	} else {
+		sv = *v
+	}
+
+	for key, value := range shape {
+		switch key {
+		case "destinationAccessToken":
+			if value != nil {
+				jtv, ok := value.(string)
+				if !ok {
+					return fmt.Errorf("expected ClientAccessToken to be of type string, got %T instead", value)
+				}
+				sv.DestinationAccessToken = ptr.String(jtv)
+			}
+
+		case "sourceAccessToken":
+			if value != nil {
+				jtv, ok := value.(string)
+				if !ok {
+					return fmt.Errorf("expected ClientAccessToken to be of type string, got %T instead", value)
+				}
+				sv.SourceAccessToken = ptr.String(jtv)
+			}
+
+		case "tunnelArn":
+			if value != nil {
+				jtv, ok := value.(string)
+				if !ok {
+					return fmt.Errorf("expected TunnelArn to be of type string, got %T instead", value)
+				}
+				sv.TunnelArn = ptr.String(jtv)
+			}
+
+		default:
+			_, _ = key, value
+
+		}
+	}
+	*v = sv
+	return nil
+}
+
 func awsAwsjson11_deserializeOpDocumentTagResourceOutput(v **TagResourceOutput, value interface{}) error {
 	if v == nil {
 		return fmt.Errorf("unexpected nil of type %T", v)
diff --git a/service/iotsecuretunneling/doc.go b/service/iotsecuretunneling/doc.go
index 77b097b3a04..712de8d6c9d 100644
--- a/service/iotsecuretunneling/doc.go
+++ b/service/iotsecuretunneling/doc.go
@@ -3,8 +3,8 @@
 // Package iotsecuretunneling provides the API client, operations, and parameter
 // types for AWS IoT Secure Tunneling.
 //
-// AWS IoT Secure Tunneling AWS IoT Secure Tunnling enables you to create remote
-// connections to devices deployed in the field. For more information about how AWS
-// IoT Secure Tunneling works, see AWS IoT Secure Tunneling
+// IoT Secure Tunneling IoT Secure Tunneling creates remote connections to devices
+// deployed in the field. For more information about how IoT Secure Tunneling
+// works, see IoT Secure Tunneling
 // (https://docs.aws.amazon.com/iot/latest/developerguide/secure-tunneling.html).
 package iotsecuretunneling
diff --git a/service/iotsecuretunneling/generated.json b/service/iotsecuretunneling/generated.json
index b53f5b384f2..797fb21f4b2 100644
--- a/service/iotsecuretunneling/generated.json
+++ b/service/iotsecuretunneling/generated.json
@@ -13,6 +13,7 @@
         "api_op_ListTagsForResource.go",
         "api_op_ListTunnels.go",
         "api_op_OpenTunnel.go",
+        "api_op_RotateTunnelAccessToken.go",
         "api_op_TagResource.go",
         "api_op_UntagResource.go",
         "deserializers.go",
diff --git a/service/iotsecuretunneling/serializers.go b/service/iotsecuretunneling/serializers.go
index 409717689e0..df7bb334603 100644
--- a/service/iotsecuretunneling/serializers.go
+++ b/service/iotsecuretunneling/serializers.go
@@ -290,6 +290,61 @@ func (m *awsAwsjson11_serializeOpOpenTunnel) HandleSerialize(ctx context.Context
 	return next.HandleSerialize(ctx, in)
 }
 
+type awsAwsjson11_serializeOpRotateTunnelAccessToken struct {
+}
+
+func (*awsAwsjson11_serializeOpRotateTunnelAccessToken) ID() string {
+	return "OperationSerializer"
+}
+
+func (m *awsAwsjson11_serializeOpRotateTunnelAccessToken) HandleSerialize(ctx context.Context, in middleware.SerializeInput, next middleware.SerializeHandler) (
+	out middleware.SerializeOutput, metadata middleware.Metadata, err error,
+) {
+	request, ok := in.Request.(*smithyhttp.Request)
+	if !ok {
+		return out, metadata, &smithy.SerializationError{Err: fmt.Errorf("unknown transport type %T", in.Request)}
+	}
+
+	input, ok := in.Parameters.(*RotateTunnelAccessTokenInput)
+	_ = input
+	if !ok {
+		return out, metadata, &smithy.SerializationError{Err: fmt.Errorf("unknown input parameters type %T", in.Parameters)}
+	}
+
+	operationPath := "/"
+	if len(request.Request.URL.Path) == 0 {
+		request.Request.URL.Path = operationPath
+	} else {
+		request.Request.URL.Path = path.Join(request.Request.URL.Path, operationPath)
+		if request.Request.URL.Path != "/" && operationPath[len(operationPath)-1] == '/' {
+			request.Request.URL.Path += "/"
+		}
+	}
+	request.Request.Method = "POST"
+	httpBindingEncoder, err := httpbinding.NewEncoder(request.URL.Path, request.URL.RawQuery, request.Header)
+	if err != nil {
+		return out, metadata, &smithy.SerializationError{Err: err}
+	}
+	httpBindingEncoder.SetHeader("Content-Type").String("application/x-amz-json-1.1")
+	httpBindingEncoder.SetHeader("X-Amz-Target").String("IoTSecuredTunneling.RotateTunnelAccessToken")
+
+	jsonEncoder := smithyjson.NewEncoder()
+	if err := awsAwsjson11_serializeOpDocumentRotateTunnelAccessTokenInput(input, jsonEncoder.Value); err != nil {
+		return out, metadata, &smithy.SerializationError{Err: err}
+	}
+
+	if request, err = request.SetStream(bytes.NewReader(jsonEncoder.Bytes())); err != nil {
+		return out, metadata, &smithy.SerializationError{Err: err}
+	}
+
+	if request.Request, err = httpBindingEncoder.Encode(request.Request); err != nil {
+		return out, metadata, &smithy.SerializationError{Err: err}
+	}
+	in.Request = request
+
+	return next.HandleSerialize(ctx, in)
+}
+
 type awsAwsjson11_serializeOpTagResource struct {
 }
 
@@ -578,6 +633,30 @@ func awsAwsjson11_serializeOpDocumentOpenTunnelInput(v *OpenTunnelInput, value s
 	return nil
 }
 
+func awsAwsjson11_serializeOpDocumentRotateTunnelAccessTokenInput(v *RotateTunnelAccessTokenInput, value smithyjson.Value) error {
+	object := value.Object()
+	defer object.Close()
+
+	if len(v.ClientMode) > 0 {
+		ok := object.Key("clientMode")
+		ok.String(string(v.ClientMode))
+	}
+
+	if v.DestinationConfig != nil {
+		ok := object.Key("destinationConfig")
+		if err := awsAwsjson11_serializeDocumentDestinationConfig(v.DestinationConfig, ok); err != nil {
+			return err
+		}
+	}
+
+	if v.TunnelId != nil {
+		ok := object.Key("tunnelId")
+		ok.String(*v.TunnelId)
+	}
+
+	return nil
+}
+
 func awsAwsjson11_serializeOpDocumentTagResourceInput(v *TagResourceInput, value smithyjson.Value) error {
 	object := value.Object()
 	defer object.Close()
diff --git a/service/iotsecuretunneling/types/enums.go b/service/iotsecuretunneling/types/enums.go
index 6fdefbc0413..ac966d2fc93 100644
--- a/service/iotsecuretunneling/types/enums.go
+++ b/service/iotsecuretunneling/types/enums.go
@@ -2,6 +2,26 @@
 
 package types
 
+type ClientMode string
+
+// Enum values for ClientMode
+const (
+	ClientModeSource      ClientMode = "SOURCE"
+	ClientModeDestination ClientMode = "DESTINATION"
+	ClientModeAll         ClientMode = "ALL"
+)
+
+// Values returns all known values for ClientMode. Note that this can be expanded
+// in the future, and so it is only as up to date as the client. The ordering of
+// this slice is not guaranteed to be stable across updates.
+func (ClientMode) Values() []ClientMode {
+	return []ClientMode{
+		"SOURCE",
+		"DESTINATION",
+		"ALL",
+	}
+}
+
 type ConnectionStatus string
 
 // Enum values for ConnectionStatus
diff --git a/service/iotsecuretunneling/types/types.go b/service/iotsecuretunneling/types/types.go
index f37f14ef7e0..51a496bf80c 100644
--- a/service/iotsecuretunneling/types/types.go
+++ b/service/iotsecuretunneling/types/types.go
@@ -23,10 +23,10 @@ type ConnectionState struct {
 // The destination configuration.
 type DestinationConfig struct {
 
-	// A list of service names that identity the target application. The AWS IoT client
+	// A list of service names that identify the target application. The IoT client
 	// running on the destination device reads this value and uses it to look up a port
-	// or an IP address and a port. The AWS IoT client instantiates the local proxy
-	// which uses this information to connect to the destination application.
+	// or an IP address and a port. The IoT client instantiates the local proxy, which
+	// uses this information to connect to the destination application.
 	//
 	// This member is required.
 	Services []string
@@ -97,8 +97,7 @@ type Tunnel struct {
 	// Timeout configuration for the tunnel.
 	TimeoutConfig *TimeoutConfig
 
-	// The Amazon Resource Name (ARN) of a tunnel. The tunnel ARN format is
-	// arn:aws:tunnel:::tunnel/
+	// The Amazon Resource Name (ARN) of a tunnel.
 	TunnelArn *string
 
 	// A unique alpha-numeric ID that identifies a tunnel.
@@ -122,8 +121,7 @@ type TunnelSummary struct {
 	// The status of a tunnel. Valid values are: Open and Closed.
 	Status TunnelStatus
 
-	// The Amazon Resource Name of the tunnel. The tunnel ARN format is
-	// arn:aws:tunnel:::tunnel/
+	// The Amazon Resource Name of the tunnel.
 	TunnelArn *string
 
 	// The unique alpha-numeric identifier for the tunnel.
diff --git a/service/iotsecuretunneling/validators.go b/service/iotsecuretunneling/validators.go
index d4366484683..dbdf811ae7f 100644
--- a/service/iotsecuretunneling/validators.go
+++ b/service/iotsecuretunneling/validators.go
@@ -90,6 +90,26 @@ func (m *validateOpOpenTunnel) HandleInitialize(ctx context.Context, in middlewa
 	return next.HandleInitialize(ctx, in)
 }
 
+type validateOpRotateTunnelAccessToken struct {
+}
+
+func (*validateOpRotateTunnelAccessToken) ID() string {
+	return "OperationInputValidation"
+}
+
+func (m *validateOpRotateTunnelAccessToken) HandleInitialize(ctx context.Context, in middleware.InitializeInput, next middleware.InitializeHandler) (
+	out middleware.InitializeOutput, metadata middleware.Metadata, err error,
+) {
+	input, ok := in.Parameters.(*RotateTunnelAccessTokenInput)
+	if !ok {
+		return out, metadata, fmt.Errorf("unknown input parameters type %T", in.Parameters)
+	}
+	if err := validateOpRotateTunnelAccessTokenInput(input); err != nil {
+		return out, metadata, err
+	}
+	return next.HandleInitialize(ctx, in)
+}
+
 type validateOpTagResource struct {
 }
 
@@ -146,6 +166,10 @@ func addOpOpenTunnelValidationMiddleware(stack *middleware.Stack) error {
 	return stack.Initialize.Add(&validateOpOpenTunnel{}, middleware.After)
 }
 
+func addOpRotateTunnelAccessTokenValidationMiddleware(stack *middleware.Stack) error {
+	return stack.Initialize.Add(&validateOpRotateTunnelAccessToken{}, middleware.After)
+}
+
 func addOpTagResourceValidationMiddleware(stack *middleware.Stack) error {
 	return stack.Initialize.Add(&validateOpTagResource{}, middleware.After)
 }
@@ -271,6 +295,29 @@ func validateOpOpenTunnelInput(v *OpenTunnelInput) error {
 	}
 }
 
+func validateOpRotateTunnelAccessTokenInput(v *RotateTunnelAccessTokenInput) error {
+	if v == nil {
+		return nil
+	}
+	invalidParams := smithy.InvalidParamsError{Context: "RotateTunnelAccessTokenInput"}
+	if v.TunnelId == nil {
+		invalidParams.Add(smithy.NewErrParamRequired("TunnelId"))
+	}
+	if len(v.ClientMode) == 0 {
+		invalidParams.Add(smithy.NewErrParamRequired("ClientMode"))
+	}
+	if v.DestinationConfig != nil {
+		if err := validateDestinationConfig(v.DestinationConfig); err != nil {
+			invalidParams.AddNested("DestinationConfig", err.(smithy.InvalidParamsError))
+		}
+	}
+	if invalidParams.Len() > 0 {
+		return invalidParams
+	} else {
+		return nil
+	}
+}
+
 func validateOpTagResourceInput(v *TagResourceInput) error {
 	if v == nil {
 		return nil
diff --git a/service/lightsail/api_op_CreateLoadBalancer.go b/service/lightsail/api_op_CreateLoadBalancer.go
index 29b6ecc2609..d9dfc87d62b 100644
--- a/service/lightsail/api_op_CreateLoadBalancer.go
+++ b/service/lightsail/api_op_CreateLoadBalancer.go
@@ -81,8 +81,8 @@ type CreateLoadBalancerInput struct {
 	// GetLoadBalancerTlsPolicies
 	// (https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetLoadBalancerTlsPolicies.html)
 	// action to get a list of TLS policy names that you can specify. For more
-	// information about load balancer TLS policies, see Load balancer TLS security
-	// policies
+	// information about load balancer TLS policies, see Configuring TLS security
+	// policies on your Amazon Lightsail load balancers
 	// (https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-configure-load-balancer-tls-security-policy)
 	// in the Amazon Lightsail Developer Guide.
 	TlsPolicyName *string
diff --git a/service/lightsail/api_op_GetLoadBalancerTlsPolicies.go b/service/lightsail/api_op_GetLoadBalancerTlsPolicies.go
index 2238f257fd8..08f4e8d54fe 100644
--- a/service/lightsail/api_op_GetLoadBalancerTlsPolicies.go
+++ b/service/lightsail/api_op_GetLoadBalancerTlsPolicies.go
@@ -13,7 +13,7 @@ import (
 
 // Returns a list of TLS security policies that you can apply to Lightsail load
 // balancers. For more information about load balancer TLS security policies, see
-// Load balancer TLS security policies
+// Configuring TLS security policies on your Amazon Lightsail load balancers
 // (https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-configure-load-balancer-tls-security-policy)
 // in the Amazon Lightsail Developer Guide.
 func (c *Client) GetLoadBalancerTlsPolicies(ctx context.Context, params *GetLoadBalancerTlsPoliciesInput, optFns ...func(*Options)) (*GetLoadBalancerTlsPoliciesOutput, error) {
diff --git a/service/lightsail/api_op_UpdateLoadBalancerAttribute.go b/service/lightsail/api_op_UpdateLoadBalancerAttribute.go
index 008f397b30f..2e841d37595 100644
--- a/service/lightsail/api_op_UpdateLoadBalancerAttribute.go
+++ b/service/lightsail/api_op_UpdateLoadBalancerAttribute.go
@@ -49,7 +49,8 @@ type UpdateLoadBalancerAttributeInput struct {
 	//
 	// * If you specify
 	// SessionStickinessEnabled for the attributeName request parameter, then the
-	// attributeValue request parameter must be true or false.
+	// attributeValue request parameter must be true to activate session stickiness or
+	// false to deactivate session stickiness.
 	//
 	// * If you specify
 	// SessionStickiness_LB_CookieDurationSeconds for the attributeName request
@@ -58,11 +59,15 @@ type UpdateLoadBalancerAttributeInput struct {
 	//
 	// * If you specify
 	// HttpsRedirectionEnabled for the attributeName request parameter, then the
-	// attributeValue request parameter must be true or false.
+	// attributeValue request parameter must be true to activate HTTP to HTTPS
+	// redirection or false to deactivate HTTP to HTTPS redirection.
 	//
 	// * If you specify
 	// TlsPolicyName for the attributeName request parameter, then the attributeValue
-	// request parameter must be TLS version 1.0, 1.1, and 1.2 or TLS version 1.2.
+	// request parameter must be the name of the TLS policy. Use the
+	// GetLoadBalancerTlsPolicies
+	// (https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_GetLoadBalancerTlsPolicies.html)
+	// action to get a list of TLS policy names that you can specify.
 	//
 	// This member is required.
 	AttributeValue *string
diff --git a/service/lightsail/types/types.go b/service/lightsail/types/types.go
index 6a6982c28d7..730a7998f38 100644
--- a/service/lightsail/types/types.go
+++ b/service/lightsail/types/types.go
@@ -2723,12 +2723,7 @@ type LoadBalancer struct {
 	// certificate is attached to the load balancer.
 	TlsCertificateSummaries []LoadBalancerTlsCertificateSummary
 
-	// The name of the TLS security policy for the load balancer. The following TLS
-	// security policy names are possible:
-	//
-	// * TLS-2016-08
-	//
-	// * TLS-FS-Res-1-2-2019-08
+	// The name of the TLS security policy for the load balancer.
 	TlsPolicyName *string
 
 	noSmithyDocumentSerde
@@ -2996,7 +2991,7 @@ type LoadBalancerTlsCertificateSummary struct {
 
 // Describes the TLS security policies that are available for Lightsail load
 // balancers. For more information about load balancer TLS security policies, see
-// Load balancer TLS security policies
+// Configuring TLS security policies on your Amazon Lightsail load balancers
 // (https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-configure-load-balancer-tls-security-policy)
 // in the Amazon Lightsail Developer Guide.
 type LoadBalancerTlsPolicy struct {
@@ -3011,31 +3006,10 @@ type LoadBalancerTlsPolicy struct {
 	// A Boolean value that indicates whether the TLS security policy is the default.
 	IsDefault *bool
 
-	// The name of the TLS security policy. The following TLS security policy names are
-	// possible:
-	//
-	// * TLS-2016-08
-	//
-	// * TLS-FS-Res-1-2-2019-08
-	//
-	// You can specify either of
-	// these values for the tlsSecurityPolicyName request parameter in the
-	// CreateLoadBalancer
-	// (https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_CreateLoadBalancer.html)
-	// action, and the attributeValue request parameter in the
-	// UpdateLoadBalancerAttribute
-	// (https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/API_UpdateLoadBalancerAttribute.html)
-	// action.
+	// The name of the TLS security policy.
 	Name *string
 
-	// The protocols used in a given TLS security policy. The following protocols are
-	// possible:
-	//
-	// * Protocol-TLSv1
-	//
-	// * Protocol-TLSv1.1
-	//
-	// * Protocol-TLSv1.2
+	// The protocols used in a given TLS security policy.
 	Protocols []string
 
 	noSmithyDocumentSerde
diff --git a/service/ssm/api_op_CreateAssociation.go b/service/ssm/api_op_CreateAssociation.go
index 9476d3f4f88..fb01d675ecb 100644
--- a/service/ssm/api_op_CreateAssociation.go
+++ b/service/ssm/api_op_CreateAssociation.go
@@ -160,6 +160,10 @@ type CreateAssociationInput struct {
 	// create an association in multiple Regions and multiple accounts.
 	TargetLocations []types.TargetLocation
 
+	// A key-value mapping of document parameters to target resources. Both Targets and
+	// TargetMaps can't be specified together.
+	TargetMaps []map[string][]string
+
 	// The targets for the association. You can target managed nodes by using tags,
 	// Amazon Web Services resource groups, all managed nodes in an Amazon Web Services
 	// account, or individual managed node IDs. You can target all managed nodes in an
diff --git a/service/ssm/api_op_UpdateAssociation.go b/service/ssm/api_op_UpdateAssociation.go
index dafb24434c5..caf9aee934a 100644
--- a/service/ssm/api_op_UpdateAssociation.go
+++ b/service/ssm/api_op_UpdateAssociation.go
@@ -177,6 +177,10 @@ type UpdateAssociationInput struct {
 	// update an association in multiple Regions and multiple accounts.
 	TargetLocations []types.TargetLocation
 
+	// A key-value mapping of document parameters to target resources. Both Targets and
+	// TargetMaps can't be specified together.
+	TargetMaps []map[string][]string
+
 	// The targets of the association.
 	Targets []types.Target
 
diff --git a/service/ssm/deserializers.go b/service/ssm/deserializers.go
index b236d996291..41e54b07249 100644
--- a/service/ssm/deserializers.go
+++ b/service/ssm/deserializers.go
@@ -742,6 +742,9 @@ func awsAwsjson11_deserializeOpErrorCreateAssociation(response *smithyhttp.Respo
 	case strings.EqualFold("InvalidTarget", errorCode):
 		return awsAwsjson11_deserializeErrorInvalidTarget(response, errorBody)
 
+	case strings.EqualFold("InvalidTargetMaps", errorCode):
+		return awsAwsjson11_deserializeErrorInvalidTargetMaps(response, errorBody)
+
 	case strings.EqualFold("UnsupportedPlatformType", errorCode):
 		return awsAwsjson11_deserializeErrorUnsupportedPlatformType(response, errorBody)
 
@@ -883,6 +886,9 @@ func awsAwsjson11_deserializeOpErrorCreateAssociationBatch(response *smithyhttp.
 	case strings.EqualFold("InvalidTarget", errorCode):
 		return awsAwsjson11_deserializeErrorInvalidTarget(response, errorBody)
 
+	case strings.EqualFold("InvalidTargetMaps", errorCode):
+		return awsAwsjson11_deserializeErrorInvalidTargetMaps(response, errorBody)
+
 	case strings.EqualFold("UnsupportedPlatformType", errorCode):
 		return awsAwsjson11_deserializeErrorUnsupportedPlatformType(response, errorBody)
 
@@ -14518,6 +14524,9 @@ func awsAwsjson11_deserializeOpErrorUpdateAssociation(response *smithyhttp.Respo
 	case strings.EqualFold("InvalidTarget", errorCode):
 		return awsAwsjson11_deserializeErrorInvalidTarget(response, errorBody)
 
+	case strings.EqualFold("InvalidTargetMaps", errorCode):
+		return awsAwsjson11_deserializeErrorInvalidTargetMaps(response, errorBody)
+
 	case strings.EqualFold("InvalidUpdate", errorCode):
 		return awsAwsjson11_deserializeErrorInvalidUpdate(response, errorBody)
 
@@ -18681,6 +18690,41 @@ func awsAwsjson11_deserializeErrorInvalidTarget(response *smithyhttp.Response, e
 	return output
 }
 
+func awsAwsjson11_deserializeErrorInvalidTargetMaps(response *smithyhttp.Response, errorBody *bytes.Reader) error {
+	var buff [1024]byte
+	ringBuffer := smithyio.NewRingBuffer(buff[:])
+
+	body := io.TeeReader(errorBody, ringBuffer)
+	decoder := json.NewDecoder(body)
+	decoder.UseNumber()
+	var shape interface{}
+	if err := decoder.Decode(&shape); err != nil && err != io.EOF {
+		var snapshot bytes.Buffer
+		io.Copy(&snapshot, ringBuffer)
+		err = &smithy.DeserializationError{
+			Err:      fmt.Errorf("failed to decode response body, %w", err),
+			Snapshot: snapshot.Bytes(),
+		}
+		return err
+	}
+
+	output := &types.InvalidTargetMaps{}
+	err := awsAwsjson11_deserializeDocumentInvalidTargetMaps(&output, shape)
+
+	if err != nil {
+		var snapshot bytes.Buffer
+		io.Copy(&snapshot, ringBuffer)
+		err = &smithy.DeserializationError{
+			Err:      fmt.Errorf("failed to decode response body, %w", err),
+			Snapshot: snapshot.Bytes(),
+		}
+		return err
+	}
+
+	errorBody.Seek(0, io.SeekStart)
+	return output
+}
+
 func awsAwsjson11_deserializeErrorInvalidTypeNameException(response *smithyhttp.Response, errorBody *bytes.Reader) error {
 	var buff [1024]byte
 	ringBuffer := smithyio.NewRingBuffer(buff[:])
@@ -20879,6 +20923,11 @@ func awsAwsjson11_deserializeDocumentAssociation(v **types.Association, value in
 				sv.ScheduleOffset = int32(i64)
 			}
 
+		case "TargetMaps":
+			if err := awsAwsjson11_deserializeDocumentTargetMaps(&sv.TargetMaps, value); err != nil {
+				return err
+			}
+
 		case "Targets":
 			if err := awsAwsjson11_deserializeDocumentTargets(&sv.Targets, value); err != nil {
 				return err
@@ -21170,6 +21219,11 @@ func awsAwsjson11_deserializeDocumentAssociationDescription(v **types.Associatio
 				return err
 			}
 
+		case "TargetMaps":
+			if err := awsAwsjson11_deserializeDocumentTargetMaps(&sv.TargetMaps, value); err != nil {
+				return err
+			}
+
 		case "Targets":
 			if err := awsAwsjson11_deserializeDocumentTargets(&sv.Targets, value); err != nil {
 				return err
@@ -22001,6 +22055,11 @@ func awsAwsjson11_deserializeDocumentAssociationVersionInfo(v **types.Associatio
 				return err
 			}
 
+		case "TargetMaps":
+			if err := awsAwsjson11_deserializeDocumentTargetMaps(&sv.TargetMaps, value); err != nil {
+				return err
+			}
+
 		case "Targets":
 			if err := awsAwsjson11_deserializeDocumentTargets(&sv.Targets, value); err != nil {
 				return err
@@ -24613,6 +24672,11 @@ func awsAwsjson11_deserializeDocumentCreateAssociationBatchRequestEntry(v **type
 				return err
 			}
 
+		case "TargetMaps":
+			if err := awsAwsjson11_deserializeDocumentTargetMaps(&sv.TargetMaps, value); err != nil {
+				return err
+			}
+
 		case "Targets":
 			if err := awsAwsjson11_deserializeDocumentTargets(&sv.Targets, value); err != nil {
 				return err
@@ -29405,6 +29469,46 @@ func awsAwsjson11_deserializeDocumentInvalidTarget(v **types.InvalidTarget, valu
 	return nil
 }
 
+func awsAwsjson11_deserializeDocumentInvalidTargetMaps(v **types.InvalidTargetMaps, value interface{}) error {
+	if v == nil {
+		return fmt.Errorf("unexpected nil of type %T", v)
+	}
+	if value == nil {
+		return nil
+	}
+
+	shape, ok := value.(map[string]interface{})
+	if !ok {
+		return fmt.Errorf("unexpected JSON type %v", value)
+	}
+
+	var sv *types.InvalidTargetMaps
+	if *v == nil {
+		sv = &types.InvalidTargetMaps{}
+	} else {
+		sv = *v
+	}
+
+	for key, value := range shape {
+		switch key {
+		case "Message":
+			if value != nil {
+				jtv, ok := value.(string)
+				if !ok {
+					return fmt.Errorf("expected String to be of type string, got %T instead", value)
+				}
+				sv.Message = ptr.String(jtv)
+			}
+
+		default:
+			_, _ = key, value
+
+		}
+	}
+	*v = sv
+	return nil
+}
+
 func awsAwsjson11_deserializeDocumentInvalidTypeNameException(v **types.InvalidTypeNameException, value interface{}) error {
 	if v == nil {
 		return fmt.Errorf("unexpected nil of type %T", v)
diff --git a/service/ssm/serializers.go b/service/ssm/serializers.go
index bd653c09b4d..cc0d2a2225a 100644
--- a/service/ssm/serializers.go
+++ b/service/ssm/serializers.go
@@ -8088,6 +8088,13 @@ func awsAwsjson11_serializeDocumentCreateAssociationBatchRequestEntry(v *types.C
 		}
 	}
 
+	if v.TargetMaps != nil {
+		ok := object.Key("TargetMaps")
+		if err := awsAwsjson11_serializeDocumentTargetMaps(v.TargetMaps, ok); err != nil {
+			return err
+		}
+	}
+
 	if v.Targets != nil {
 		ok := object.Key("Targets")
 		if err := awsAwsjson11_serializeDocumentTargets(v.Targets, ok); err != nil {
@@ -10581,6 +10588,13 @@ func awsAwsjson11_serializeOpDocumentCreateAssociationInput(v *CreateAssociation
 		}
 	}
 
+	if v.TargetMaps != nil {
+		ok := object.Key("TargetMaps")
+		if err := awsAwsjson11_serializeDocumentTargetMaps(v.TargetMaps, ok); err != nil {
+			return err
+		}
+	}
+
 	if v.Targets != nil {
 		ok := object.Key("Targets")
 		if err := awsAwsjson11_serializeDocumentTargets(v.Targets, ok); err != nil {
@@ -13874,6 +13888,13 @@ func awsAwsjson11_serializeOpDocumentUpdateAssociationInput(v *UpdateAssociation
 		}
 	}
 
+	if v.TargetMaps != nil {
+		ok := object.Key("TargetMaps")
+		if err := awsAwsjson11_serializeDocumentTargetMaps(v.TargetMaps, ok); err != nil {
+			return err
+		}
+	}
+
 	if v.Targets != nil {
 		ok := object.Key("Targets")
 		if err := awsAwsjson11_serializeDocumentTargets(v.Targets, ok); err != nil {
diff --git a/service/ssm/types/errors.go b/service/ssm/types/errors.go
index adcf8724b0b..e335ea9ebe3 100644
--- a/service/ssm/types/errors.go
+++ b/service/ssm/types/errors.go
@@ -1551,6 +1551,25 @@ func (e *InvalidTarget) ErrorMessage() string {
 func (e *InvalidTarget) ErrorCode() string             { return "InvalidTarget" }
 func (e *InvalidTarget) ErrorFault() smithy.ErrorFault { return smithy.FaultClient }
 
+// TargetMap parameter isn't valid.
+type InvalidTargetMaps struct {
+	Message *string
+
+	noSmithyDocumentSerde
+}
+
+func (e *InvalidTargetMaps) Error() string {
+	return fmt.Sprintf("%s: %s", e.ErrorCode(), e.ErrorMessage())
+}
+func (e *InvalidTargetMaps) ErrorMessage() string {
+	if e.Message == nil {
+		return ""
+	}
+	return *e.Message
+}
+func (e *InvalidTargetMaps) ErrorCode() string             { return "InvalidTargetMaps" }
+func (e *InvalidTargetMaps) ErrorFault() smithy.ErrorFault { return smithy.FaultClient }
+
 // The parameter type name isn't valid.
 type InvalidTypeNameException struct {
 	Message *string
diff --git a/service/ssm/types/types.go b/service/ssm/types/types.go
index 41beb327a6c..0a9131c54a7 100644
--- a/service/ssm/types/types.go
+++ b/service/ssm/types/types.go
@@ -104,6 +104,10 @@ type Association struct {
 	// Number of days to wait after the scheduled day to run an association.
 	ScheduleOffset int32
 
+	// A key-value mapping of document parameters to target resources. Both Targets and
+	// TargetMaps can't be specified together.
+	TargetMaps []map[string][]string
+
 	// The managed nodes targeted by the request to create an association. You can
 	// target all managed nodes in an Amazon Web Services account by specifying the
 	// InstanceIds key with a value of *.
@@ -224,6 +228,10 @@ type AssociationDescription struct {
 	// where you want to run the association.
 	TargetLocations []TargetLocation
 
+	// A key-value mapping of document parameters to target resources. Both Targets and
+	// TargetMaps can't be specified together.
+	TargetMaps []map[string][]string
+
 	// The managed nodes targeted by the request.
 	Targets []Target
 
@@ -480,6 +488,10 @@ type AssociationVersionInfo struct {
 	// created.
 	TargetLocations []TargetLocation
 
+	// A key-value mapping of document parameters to target resources. Both Targets and
+	// TargetMaps can't be specified together.
+	TargetMaps []map[string][]string
+
 	// The targets specified for the association when the association version was
 	// created.
 	Targets []Target
@@ -1569,6 +1581,10 @@ type CreateAssociationBatchRequestEntry struct {
 	// accounts.
 	TargetLocations []TargetLocation
 
+	// A key-value mapping of document parameters to target resources. Both Targets and
+	// TargetMaps can't be specified together.
+	TargetMaps []map[string][]string
+
 	// The managed nodes targeted by the request.
 	Targets []Target
 
diff --git a/service/synthetics/internal/endpoints/endpoints.go b/service/synthetics/internal/endpoints/endpoints.go
index dbed0ce2f6c..ce47a850b0c 100644
--- a/service/synthetics/internal/endpoints/endpoints.go
+++ b/service/synthetics/internal/endpoints/endpoints.go
@@ -183,6 +183,42 @@ var defaultPartitions = endpoints.Partitions{
 			endpoints.EndpointKey{
 				Region: "eu-west-3",
 			}: endpoints.Endpoint{},
+			endpoints.EndpointKey{
+				Region: "fips-us-east-1",
+			}: endpoints.Endpoint{
+				Hostname: "synthetics-fips.us-east-1.amazonaws.com",
+				CredentialScope: endpoints.CredentialScope{
+					Region: "us-east-1",
+				},
+				Deprecated: aws.TrueTernary,
+			},
+			endpoints.EndpointKey{
+				Region: "fips-us-east-2",
+			}: endpoints.Endpoint{
+				Hostname: "synthetics-fips.us-east-2.amazonaws.com",
+				CredentialScope: endpoints.CredentialScope{
+					Region: "us-east-2",
+				},
+				Deprecated: aws.TrueTernary,
+			},
+			endpoints.EndpointKey{
+				Region: "fips-us-west-1",
+			}: endpoints.Endpoint{
+				Hostname: "synthetics-fips.us-west-1.amazonaws.com",
+				CredentialScope: endpoints.CredentialScope{
+					Region: "us-west-1",
+				},
+				Deprecated: aws.TrueTernary,
+			},
+			endpoints.EndpointKey{
+				Region: "fips-us-west-2",
+			}: endpoints.Endpoint{
+				Hostname: "synthetics-fips.us-west-2.amazonaws.com",
+				CredentialScope: endpoints.CredentialScope{
+					Region: "us-west-2",
+				},
+				Deprecated: aws.TrueTernary,
+			},
 			endpoints.EndpointKey{
 				Region: "me-south-1",
 			}: endpoints.Endpoint{},
@@ -192,15 +228,39 @@ var defaultPartitions = endpoints.Partitions{
 			endpoints.EndpointKey{
 				Region: "us-east-1",
 			}: endpoints.Endpoint{},
+			endpoints.EndpointKey{
+				Region:  "us-east-1",
+				Variant: endpoints.FIPSVariant,
+			}: {
+				Hostname: "synthetics-fips.us-east-1.amazonaws.com",
+			},
 			endpoints.EndpointKey{
 				Region: "us-east-2",
 			}: endpoints.Endpoint{},
+			endpoints.EndpointKey{
+				Region:  "us-east-2",
+				Variant: endpoints.FIPSVariant,
+			}: {
+				Hostname: "synthetics-fips.us-east-2.amazonaws.com",
+			},
 			endpoints.EndpointKey{
 				Region: "us-west-1",
 			}: endpoints.Endpoint{},
+			endpoints.EndpointKey{
+				Region:  "us-west-1",
+				Variant: endpoints.FIPSVariant,
+			}: {
+				Hostname: "synthetics-fips.us-west-1.amazonaws.com",
+			},
 			endpoints.EndpointKey{
 				Region: "us-west-2",
 			}: endpoints.Endpoint{},
+			endpoints.EndpointKey{
+				Region:  "us-west-2",
+				Variant: endpoints.FIPSVariant,
+			}: {
+				Hostname: "synthetics-fips.us-west-2.amazonaws.com",
+			},
 		},
 	},
 	{
@@ -333,12 +393,42 @@ var defaultPartitions = endpoints.Partitions{
 		RegionRegex:    partitionRegexp.AwsUsGov,
 		IsRegionalized: true,
 		Endpoints: endpoints.Endpoints{
+			endpoints.EndpointKey{
+				Region: "fips-us-gov-east-1",
+			}: endpoints.Endpoint{
+				Hostname: "synthetics-fips.us-gov-east-1.amazonaws.com",
+				CredentialScope: endpoints.CredentialScope{
+					Region: "us-gov-east-1",
+				},
+				Deprecated: aws.TrueTernary,
+			},
+			endpoints.EndpointKey{
+				Region: "fips-us-gov-west-1",
+			}: endpoints.Endpoint{
+				Hostname: "synthetics-fips.us-gov-west-1.amazonaws.com",
+				CredentialScope: endpoints.CredentialScope{
+					Region: "us-gov-west-1",
+				},
+				Deprecated: aws.TrueTernary,
+			},
 			endpoints.EndpointKey{
 				Region: "us-gov-east-1",
 			}: endpoints.Endpoint{},
+			endpoints.EndpointKey{
+				Region:  "us-gov-east-1",
+				Variant: endpoints.FIPSVariant,
+			}: {
+				Hostname: "synthetics-fips.us-gov-east-1.amazonaws.com",
+			},
 			endpoints.EndpointKey{
 				Region: "us-gov-west-1",
 			}: endpoints.Endpoint{},
+			endpoints.EndpointKey{
+				Region:  "us-gov-west-1",
+				Variant: endpoints.FIPSVariant,
+			}: {
+				Hostname: "synthetics-fips.us-gov-west-1.amazonaws.com",
+			},
 		},
 	},
 }